skills.rest
blacklanternsecurity
blacklanternsecurityOFFICIAL
Explore all skills by this author →
WebsiteGitHub

xss-reflected

Guide reflected XSS exploitation with curl payload injection and filter bypass techniques.

253|37|Updated Feb 22, 2026
Search Tags:#xss#penetration testing#web security#payloads#reflected xss#javascript injection
One-click install
npx skills add https://github.com/blacklanternsecurity/red-run --skill xss-reflected
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: xss-reflected
Source: https://github.com/blacklanternsecurity/red-run/tree/main/skills/web/xss-reflected
Command: npx skills add https://github.com/blacklanternsecurity/red-run --skill xss-reflected

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps penetration testers identify and exploit reflected Cross-Site Scripting (XSS) vulnerabilities in web applications, enabling JavaScript execution in the victim's browser.

Core Features & Use Cases

  • Payload Testing: Utilizes curl to inject various XSS payloads into URL parameters and headers.
  • Contextual Analysis: Guides the user to identify where input is reflected in the HTML response (attributes, script blocks, comments, etc.).
  • Filter & WAF Bypass: Provides techniques to circumvent common input filters, Web Application Firewalls (WAFs), and Content Security Policies (CSPs).
  • Impact Demonstration: Facilitates demonstrating real-world impact through cookie theft, session hijacking, phishing, and keylogging.
  • Use Case: A penetration tester finds user input reflected in a search result page. They use this Skill to craft and inject a payload that executes JavaScript, demonstrating the ability to steal session cookies.

Quick Start

Use the xss-reflected skill to test for reflected XSS on the target URL 'https://example.com/search?q=test'.

Frequently Asked Questions about xss-reflected

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I exploit reflected XSS vulnerabilities during penetration testing?▼

To exploit reflected XSS, assess URL reflection points, identify active input filters or WAFs, and apply contextual bypass techniques for tags, parentheses, quotes, and encoding to achieve JavaScript injection.

What is the best way to bypass WAF filters for JavaScript injection?▼

Bypass WAF filters for JavaScript injection by analyzing the HTML reflection context and applying specific bypass techniques for restricted tags, spaces, dots, quotes, and character encoding.

How do I demonstrate the impact of a reflected XSS vulnerability?▼

Demonstrate the impact of reflected XSS by injecting payloads that execute JavaScript to perform cookie theft, session hijacking, phishing, and keylogging, proving unauthorized access to victim session data.

Why does my reflected XSS payload fail to execute in the browser?▼

Reflected XSS payloads fail to execute due to unhandled input filters, Content Security Policies, or incorrect contextual analysis of the reflection point within HTML attributes, script blocks, or comments.

Can I use curl to test URL parameters for reflected XSS?▼

Yes, use curl to test URL parameters for reflected XSS by injecting various payloads into URL parameters and headers, then analyzing the HTML response to identify where the input is reflected.

Related Skills

Explore More Software Engineering Skills→
blacklanternsecurityblacklanternsecurity
253

web-discovery

Discover web application injection points and test for common vulnerability classes.

Official
Advanced
harperaaharperaa
15

authentication-authorization-clerk

Authenticate users and authorize access via Clerk APIs.

Community
Intermediate
jellaharshithjellaharshith
1

hunt-xss

Detect reflected, stored, and DOM XSS vulnerabilities with OOB confirmation.

Community
Advanced
rahmatullahbossrahmatullahboss

Cross-Site Scripting and HTML Injection Testing

Identify XSS vulnerabilities and craft payloads for stored, reflected, and DOM-based vectors.

Community
Advanced