Cross-Site Scripting Assessment

Purpose

Find and validate XSS by mapping controllable sources to browser execution contexts, proving execution safely, and handing off callback or parser work when needed.

Use When

• The owner phase is reflected, stored, DOM, or blind XSS.
• The task needs HTML, attribute, JavaScript, URL, CSS, template, or browser-sink context analysis.
• CSP, WAF, sanitizer, encoding, or client-side source-to-sink behavior is central.

Inputs

• Target URL, parameter, header, cookie, body field, DOM source, or captured request.
• Scope and target allowlist.
• Authenticated session or test account when stored or admin-viewed surfaces are involved.
• Optional CSP, sanitizer behavior, client-side source, proxy traffic, and OOB listener details.