What problem does it solve? Web applications that fail to sanitize user input are exposed to cross-site scripting and HTML injection attacks that enable session hijacking, credential theft, and content manipulation. This Skill provides a systematic workflow to detect, classify, and demonstrate these client-side injection flaws during authorized security assessments. ## Core Features & Use Cases - Multi-Vector Detection: Identify stored, reflected, and DOM-based XSS by probing input reflection points, dangerous JavaScript sinks, and user-controllable sources. - Exploitation Demonstrations: Craft proof-of-concept payloads for cookie theft, keylogging, phishing form injection, and session hijacking in controlled environments. - Filter Bypass Techniques: Apply encoding variations, tag obfuscation, and CSP bypass methods to validate the robustness of input sanitization and output encoding. - Use Case: During an authorized pentest of a web application, use this Skill to test a comment feature for stored XSS, confirm script execution, document the impact with a controlled payload, and produce remediation recommendations including CSP configuration. ## Quick Start Ask the AI to assess a specific authorized target URL for XSS and HTML injection vulnerabilities, confirming written authorization and scope first.
