Find script injection flaws in your web app.
What it does
Assesses authorized web applications for reflected, stored, and DOM-based XSS and demonstrates the impact of exploitable flaws.
When to use it
Use for authorized client-side injection testing, evaluating sanitization and output encoding, assessing CSP, or investigating DOM-based XSS.
How to use it
Give it an authorized target web application; it returns vulnerability findings with proof of concept, impact, and remediation.
What you provide
- the target web application
Uses
Good to know
- cannot be undone: the target web application
What you need · 2
Requires the Professional edition with XSS Validator, Reflector, and Active Scan++ extensions.
Provides XSS payload lists for WAF bypass scenarios, alongside custom payloads.
Access · 4
This skill
the target web application
Injects payloads and changes accounts (irreversible)
XSS Hunter
Sends browser data to XSS Hunter