xss-tester

XSS Tester

Execute XSS vulnerability testing across all context types and frameworks. Use Playwright for browser interaction and evidence capture. Generate verified PoCs with screenshot proof.

Workflow

Phase 1: Recon

1. Mount skill and payload files:

   Read plugins/pentest/skills/common-appsec-patterns/SKILL.md
   Read plugins/pentest/skills/pentest/attacks/client-side/xss/payloads/basic.md
   Read plugins/pentest/skills/pentest/attacks/client-side/xss/payloads/bypass.md
   Read plugins/pentest/skills/pentest/attacks/client-side/xss/payloads/dom.md
   Read plugins/pentest/skills/pentest/attacks/client-side/xss/xss-bypass-techniques.md
   Read plugins/pentest/skills/pentest/attacks/client-side/xss/xss-exploitation-techniques.md
   Read plugins/pentest/skills/pentest/attacks/client-side/dom-based/dom-xss-quickstart.md
   

2. Navigate to the target and take an initial snapshot:

   browser_navigate(url="https://TARGET")
   browser_snapshot()
   

3. Identify all input points: URL parameters, GET/POST forms, search fields, comment fields, rich text editors, JSON API fields, HTTP headers reflected in response.
4. Classify each reflection context:
   • HTML body: <div>USER_INPUT</div>
   • HTML attribute: <input value="USER_INPUT">
   • JavaScript string: var x = "USER_INPUT";
   • URL: <a href="/search?q=USER_INPUT">
   • CSS: style="color:USER_INPUT"
5. Detect active defenses:

   browser_network_requests()   # Inspect Content-Security-Policy header
   

   Also check for encoding behavior: does < become <? Does " become "? Check for WAF indicators: 403 on payloads, Cloudflare/ModSecurity headers.
6. Log:

   {"timestamp":"...","agent":"xss-tester","action":"recon","target":"https://TARGET","input_points":8,"contexts":["html","attr","js-string"],"csp_present":false}
   

Phase 2: Experiment

For each input point:

1. Start with harmless markers to test if input reflects at all:

   browser_type(ref="input[name=q]", text="XSSTEST123")
   browser_click(ref="button[type=submit]")
   browser_snapshot()
   

   Check: does XSSTEST123 appear in the DOM? Is it encoded?
2. Test HTML tag injection:

   browser_type(ref="input[name=q]", text="<b>bold</b>")
   browser_click(ref="button[type=submit]")
   browser_snapshot()
   

   Check: does <b>bold</b> render as bold text (tag executed) or as literal text (encoded)?
3. Test basic XSS payload:

   browser_type(ref="input[name=q]", text="<script>alert(1)</script>")
   browser_click(ref="button[type=submit]")
   browser_console_messages()
   browser_snapshot()
   

4. Test event handler payload:

   browser_type(ref="input[name=q]", text='<img src=x onerror=alert(document.domain)>')
   browser_click(ref="button[type=submit]")
   browser_console_messages()
   

5. Log each probe:

   {"timestamp":"...","agent":"xss-tester","action":"experiment","input":"search-q","payload":"<script>alert(1)</script>","result":"blocked"}