xss-cross-site-scripting

What problem does it solve?

It helps you systematically discover and validate cross-site scripting paths when input is reflected or stored across different HTML/attribute/JS/URL contexts, and when modern mitigations like CSP and Trusted Types complicate exploitation.

Core Features & Use Cases

• Injection-context driven payload selection: choose the right attack string based on whether reflection occurs in HTML body, attributes, script blocks, URL sinks, or XML contexts.
• Second-order and blind XSS workflows: craft payloads that survive storage/encoding and cover parameters that are not immediately reflected.
• Advanced bypass and post-exploitation guidance: use mXSS/DOMPurify differentials, DOM clobbering, Trusted Types policy gaps, CSP bypass vectors, XS-Leaks side channels, and session-fixation/HttpOnly-relevant exploitation paths.
• Framework and persistence vectors: cover modern framework XSS patterns (React/Vue/Angular/Next.js) and service worker persistence after successful script execution.

Quick Start

Use the xss-cross-site-scripting skill to enumerate likely reflection contexts for your target inputs and then select an appropriate advanced payload for each sink to confirm execution and escalation paths.