pentest-xss

Guide penetration testers in discovering and exploiting XSS vulnerabilities in web applications.

74|10|Updated Mar 5, 2026

Search Tags:#xss #vulnerability assessment #penetration testing #web security #payloads #cross-site scripting

Ready to run

npx skills add https://github.com/yhy0/ghsa-skill-builder --skill pentest-xss

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: pentest-xss
Source: https://github.com/yhy0/ghsa-skill-builder/tree/main/vuln-skills/skills/pentest-xss
Command: npx skills add https://github.com/yhy0/ghsa-skill-builder --skill pentest-xss

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill provides a comprehensive guide and checklist for identifying, exploiting, and assessing Cross-Site Scripting (XSS) vulnerabilities during penetration tests.

Core Features & Use Cases

Attack Surface Discovery: Identifies high-risk input points and recognition signals for XSS.
Exploitation Techniques: Details various payload construction, filtering bypasses, and exploitation chains for Stored, Reflected, and DOM-based XSS.
Detection Checklist: Offers a structured approach to systematically test for XSS.
Impact Assessment: Helps in evaluating the severity and potential consequences of discovered XSS flaws.
Real-World Cases: Provides examples from HackerOne reports to illustrate practical attack scenarios.

Quick Start

Use the pentest-xss skill to identify potential XSS vulnerabilities in the target web application.

Frequently Asked Questions about pentest-xss

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I identify cross-site scripting attack surfaces in web applications?▼

Identify cross-site scripting attack surfaces by analyzing high-risk input points and recognition signals. This skill guides penetration testers in systematically mapping potential XSS entry vectors across target web applications.

How do I craft payloads to bypass Content Security Policy when testing for XSS?▼

Craft payloads to bypass Content Security Policy using detailed filtering bypass techniques and exploitation chains. The skill leverages HTML, JavaScript, and DOM manipulation knowledge to construct effective XSS payloads.

What is the difference between detecting Stored, Reflected, and DOM-based XSS vulnerabilities?▼

Stored, Reflected, and DOM-based XSS vulnerabilities differ in payload persistence and execution locations. This skill provides distinct exploitation techniques and detection checklists to systematically test each variant.

How do I assess the impact and severity of discovered XSS flaws during a penetration test?▼

Assess the impact and severity of discovered XSS flaws by evaluating potential consequences using real-world HackerOne cases. This helps penetration testers accurately determine the risk level of cross-site scripting vulnerabilities.

What prerequisite knowledge do I need to effectively hunt for XSS vulnerabilities?▼

To hunt for XSS vulnerabilities effectively, you need prerequisite knowledge of HTML, JavaScript, DOM manipulation, and security headers like CSP. This skill applies these concepts to payload crafting and attack surface discovery.