Map reflection points and probe sanitizers to validate Cross-Site Scripting vulnerabilities.
npx skills add https://github.com/pdparchitect/rook --skill hunt-xss-pdparchitect
Please help me install this Agent Skill. Skill: hunt-xss Source: https://github.com/pdparchitect/rook/tree/main/skills/hunt-xss Command: npx skills add https://github.com/pdparchitect/rook --skill hunt-xss-pdparchitect
This skill addresses the complexity of identifying and validating Cross-Site Scripting (XSS) vulnerabilities by providing a structured, research-backed methodology that minimizes false positives and maximizes impact.
Use the hunt-xss skill to audit the provided target repository for reflected and stored XSS vulnerabilities following the documented research methodology.
High-intent search queries and answers about installing and using this skill.
To find and validate XSS vulnerabilities, you map input reflection points and probe sanitizer behavior using canary markers. This methodology minimizes false positives by requiring browser-based confirmation of terminal impact, ensuring findings demonstrate real-world exploitability.
Mapping reflection points requires injecting strict canary markers into input fields and tracing their reflection in the web application's output. This systematic approach identifies exactly where untrusted data enters the browser context, enabling targeted sanitizer probing and bypass testing.
Yes, this methodology directly supports bug bounty hunting and stored XSS research. It provides a structured framework for probing sanitizer behavior and chaining validated Cross-Site Scripting findings into high-value outcomes like account takeover, token exfiltration, and privilege escalation.
Yes, this approach specifically tests complex sanitizer bypasses through systematic probing of input handling mechanisms. It provides a structured framework for analyzing sanitizer behavior and testing bypasses, maintaining strict canary marker discipline to accurately track and validate reflection points.
Browser-based confirmation of terminal impact is required to minimize false positives and maximize vulnerability value. This methodology ensures that Cross-Site Scripting findings are validated with real-world impact, such as account takeover or token exfiltration, rather than relying on simple alert boxes as proof.
balic-AI-ML-R-D-ResourcesMap and analyze application entry points to assess security risk.
uphiagoDetect modern CSRF vulnerabilities including SameSite bypasses and OAuth RelayState flaws.
AcczdyAutomate web application penetration testing following the OWASP WSTG with Burp Suite.
AndyAnh174Detect and exploit stored, reflected, and DOM-based XSS vulnerabilities.
