rather than <script>. Use a unique numeric canary like alert(91234) so you can distinguish your reflection from decoy example payloads on the page."}},{"@type":"Question","name":"How to test for blind or stored XSS vulnerabilities?","acceptedAnswer":{"@type":"Answer","text":"Plant out-of-band beacons (e.g., a unique Collaborator subdomain) in fields viewed later by admins, such as error messages, User-Agent headers, or login usernames. Confirmation only counts when your OOB listener receives a request from a browser User-Agent, which may arrive hours or days later."}},{"@type":"Question","name":"What is the difference between XSS and HTML injection?","acceptedAnswer":{"@type":"Answer","text":"HTML injection reflects raw markup but cannot execute JavaScript, while XSS achieves actual script execution via

Verified:Website GitHub

hunt-xss

Detect and validate reflected, stored, and DOM-based XSS vulnerabilities on web targets.

Updated Sep 6, 2026

Search Tags:#xss #penetration testing #web security #bug bounty #vulnerability hunting #csp bypass #sanitizer bypass

One-click install

npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-xss-inventashif

Or copy as Structured Prompt for Agent▼

Please help me install this Agent Skill.
Skill: hunt-xss
Source: https://github.com/inventashif/helpful-code-sidekick/tree/main/scripts/hackerai/skills/bughunter/hunt-xss
Command: npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-xss-inventashif

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Finding cross-site scripting (XSS) vulnerabilities requires distinguishing real exploitable reflections from safe output encoding, and most reports get rejected because the payload was HTML-encoded, self-XSS only, or never actually executed in a browser. This Skill provides a structured hunting methodology built from 174 public bug bounty reports so you can find, confirm, and chain XSS into reportable impact. ## Core Features & Use Cases - Reflection Verification Discipline: Uses unique numeric canaries and marker hygiene rules to separate your payload from page decoys and correctly identify HTML-encoded (safe) versus unescaped (vulnerable) output. - Full-Spectrum Coverage: Step-by-step methodology for reflected, stored, DOM-based, blind (OOB-confirmed), SVG upload, markdown renderer, and cache-poisoning XSS vectors, plus CSP, sanitizer, WAF, and AngularJS sandbox bypass techniques. - Chain Composition Guidance: Six documented chains that escalate standalone XSS into account takeover, token exfiltration, and privilege escalation, with Gate 0 validation questions to confirm reportable impact before submission. - Use Case: While testing a target's search endpoint, you probe with a unique canary, confirm unescaped reflection, escalate to a stored payload in a profile field, and chain it with a CSRF endpoint to demonstrate account takeover in the report. ## Quick Start Ask the AI to hunt for XSS vulnerabilities on your authorized target URL, starting by mapping reflection points and probing them with a unique canary payload.

Frequently Asked Questions about hunt-xss

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I confirm a reflected XSS vulnerability is real?▼

Confirm XSS by checking that your payload appears in the response with unescaped angle brackets, such as a literal <script>alert(canary)</script> rather than <script>. Use a unique numeric canary like alert(91234) so you can distinguish your reflection from decoy example payloads on the page.

How to test for blind or stored XSS vulnerabilities?▼

Plant out-of-band beacons (e.g., a unique Collaborator subdomain) in fields viewed later by admins, such as error messages, User-Agent headers, or login usernames. Confirmation only counts when your OOB listener receives a request from a browser User-Agent, which may arrive hours or days later.

What is the difference between XSS and HTML injection?▼

HTML injection reflects raw markup but cannot execute JavaScript, while XSS achieves actual script execution via <script> tags or event handlers. If only markup injection is possible, use the hunt-html-injection skill and escalate to XSS testing once script execution becomes possible.

Can XSS bypass a Content Security Policy?▼

Yes, common CSP bypasses include SVG uploads served as image/svg+xml without CSP, JSONP endpoints on whitelisted domains, unsafe-inline in style-src, and script gadgets on allowed CDNs. The skill documents specific bypass patterns for each scenario.

Why was my XSS report rejected as not vulnerable?▼

Reports are commonly rejected when the payload appears HTML-encoded in the response, when it is self-XSS that only fires in your own session, or when no real browser execution was demonstrated. Always validate in a current Chrome or Firefox build and show concrete impact like session token access.

When should XSS be chained with other vulnerabilities?▼

Chain XSS when standalone impact is low: combine reflected XSS with cache poisoning for stored-equivalent scale, self-XSS with CSRF for account takeover, or DOM XSS on OAuth callbacks for token theft. Chained findings typically pay significantly more than standalone XSS.