hunt-xss

Blind XSS verification requires out-of-band callback logic to confirm execution in hidden contexts like admin panels. You inject canary markers into stored inputs, then monitor for OOB callbacks proving execution triggered on authenticated surfaces.

Reflection mapping identifies exactly where untrusted input echoes in application responses, classifying contexts as reflected, stored, or DOM-based. This classification determines which payload variations can execute, preventing false positives from encoding or WAF noise.

CSP bypass and sanitizer probing test common filter weaknesses using SVG/math+style vectors and redirect/UTM parameters. Systematic probing of context-aware payloads identifies specific sanitization gaps to achieve reliable execution.

Stored XSS validation in collaborative renderers uses real-browser verification to confirm reproducible execution. You inject context-aware payloads into shared inputs, then validate the execution path triggers reliably upon rendering without false positives.

This XSS testing workflow requires no external dependencies but needs a real-browser environment for final verification. It guides systematic canary marker testing and context-aware payload selection suitable for high-value surfaces like SSO flows and SVG endpoints.