xss-reflected

Name: xss-reflected
Availability: InStock
Author: SecurityforTech

Detect and exploit reflected XSS vulnerabilities by injecting crafted payloads into HTTP responses.

6|1|Updated Mar 9, 2026

Search Tags:#xss #injection #web security #vulnerability testing #pentesting #reflected xss

Ready to run

npx skills add https://github.com/securityfortech/hacking-skills --skill xss-reflected-securityfortech

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: xss-reflected
Source: https://github.com/securityfortech/hacking-skills/tree/main/skills/web/injection/xss-reflected
Command: npx skills add https://github.com/securityfortech/hacking-skills --skill xss-reflected-securityfortech

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps identify and exploit Reflected Cross-Site Scripting (XSS) vulnerabilities, where user input is echoed back into an HTTP response without proper sanitization, allowing for script execution in the victim's browser.

Core Features & Use Cases

Input Vector Mapping: Identifies all potential points where user input is processed.
Payload Crafting: Generates context-aware payloads for various reflection points (HTML body, attributes, script blocks).
Bypass Techniques: Employs various encoding and manipulation methods to bypass filters.
Use Case: A pentester can use this skill to quickly test for and demonstrate the impact of reflected XSS on a web application, potentially leading to session hijacking or credential theft.

Quick Start

Use the xss-reflected skill to test for reflected XSS by injecting '<script>alert(1)</script>' into the 'user' parameter of the target URL.

Frequently Asked Questions about xss-reflected

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect reflected XSS vulnerabilities in web applications?▼

Detect reflected XSS by injecting crafted payloads into HTTP responses to identify reflection points in HTML, attributes, and script blocks where user input is echoed without proper sanitization.

How do I bypass XSS filters when testing reflected input?▼

Bypass XSS filters by employing encoding and manipulation methods for filter evasion, testing context-aware payloads against different reflection points within the web application.

Do I need Burp Suite or OWASP ZAP to test for reflected XSS?▼

Yes, comprehensive reflected XSS testing requires tools like Burp Suite or OWASP ZAP to verify script execution in a browser and analyze HTTP request and response cycles.

How do I craft context-aware XSS payloads for HTML attributes and script blocks?▼

Craft context-aware XSS payloads by mapping input vectors and generating specific injections tailored for various reflection points including HTML body, attributes, and script blocks.

What is the difference between reflected and stored XSS vulnerabilities?▼

Reflected XSS occurs when user input is echoed immediately in an HTTP response, whereas stored XSS involves persisting the malicious input within the application's database.

How do I map input vectors for vulnerability testing?▼

Map input vectors for vulnerability testing by identifying all potential points where user input is processed and echoed back into the web application's HTTP responses.