Detect and validate reflected, stored, and DOM-based XSS vulnerabilities in web applications.
npx skills add https://github.com/Wyl-cmd/kxns-cli --skill hunt-xss-wyl-cmd
Please help me install this Agent Skill. Skill: hunt-xss Source: https://github.com/Wyl-cmd/kxns-cli/tree/main/src/kxns_cli/skills/hunt-xss Command: npx skills add https://github.com/Wyl-cmd/kxns-cli --skill hunt-xss-wyl-cmd
dangerouslySetInnerHTML and v-html. - Blind XSS OOB Validation: Uses out-of-band callback beacons planted in error fields, headers, and login forms to confirm stored XSS that fires in admin panels or log viewers. - Bypass & Chaining Playbooks: Covers CSP bypasses, sanitizer/mXSS evasion, SVG upload vectors, and chains that escalate XSS into account takeover via cache poisoning, CSRF, OAuth token theft, and postMessage abuse. - Use Case: While testing a target's wiki feature, use the markdown renderer payloads and Kroki injection patterns to plant a stored XSS, then confirm execution via a Collaborator callback when an admin views the page. ## Quick Start Ask the agent to hunt for XSS vulnerabilities on the target application, starting by mapping reflection points and verifying sinks before reporting any findings.High-intent search queries and answers about installing and using this skill.
Map every reflection point where user input appears in HTML output, then probe with unique canary strings to determine the output context. Select context-appropriate payloads and always verify execution in a real browser before reporting.
Plant out-of-band beacons with unique subdomains in fields likely viewed later by admins, such as error messages, User-Agent headers, and login usernames. A callback to your listener from a browser User-Agent confirms execution.
Modern frameworks like React, Vue, and Angular escape output by default, so reflection alone is not exploitable. Check whether the input reaches a dangerous sink such as dangerouslySetInnerHTML, v-html, or innerHTML before claiming XSS.
Yes, common bypasses include SVG uploads served without CSP, JSONP endpoints on whitelisted domains, base-uri injection, and AngularJS CDN gadgets. The Skill documents specific payload patterns for each bypass scenario.
XSS pays most when chained to account takeover, token exfiltration, or privilege escalation, such as cache-poisoned stored XSS on sign-in pages or OAuth fragment token theft. Standalone alert-box XSS typically rates Low to Medium.
AKasem1Discover subdomains, live hosts, and actionable URLs for web2 vulnerability hunting.
chatbotkitIdentify and document account takeover vectors across authentication flows and settings.
chatbotkitIdentify and reproduce cache-poisoning vulnerabilities in CDN-backed applications.
op7icOrchestrate end-to-end threat hunts against Cisco Secure Endpoint data.