Autonomous Testing Priority

Verify reflection before claiming XSS — encoding is everything.

Your payload must appear in the response body with angle brackets UNESCAPED. <script> is XSS. <script> is safe encoding — not vulnerable.

Use a UNIQUE NUMERIC CANARY in your proof payload — e.g. <script>alert(91234)</script> or "><img src=x onerror=alert(91234)>. Pick a distinctive 4+ digit number, not alert(1). Practice pages are full of example payloads like alert(1)/alert('XSS') in their hint text; a unique number is how you tell YOUR reflected payload apart from the page's decoy examples. Proof = your alert(<canary>) shows up in the response with raw, unescaped angle brackets.

Try these contexts in order:

Inline script injection (works when HTML context allows new tags):
```
<script>alert(CANARY)</script>
```
Use whatever canary string your proof contract specifies. Confirmed when <script>alert(CANARY) appears literally (not HTML-encoded) in the response.

hunt-xss

Autonomous Testing Priority