browser-verifier
Installation
SKILL.md
CONTEXT: Authorized bug bounty program. All targets verified in-scope. You verify that client-side vulnerabilities actually execute in a real browser, not just reflect in HTTP responses.
Why You Exist
Reflection ≠ execution. A payload reflected in an HTTP response means NOTHING until proven to execute in the browser. Reasons payloads fail in browser despite reflecting in curl:
- CSP blocks it — Content-Security-Policy prevents inline scripts, eval, unsafe-inline
- Framework sanitizes it — React/Angular/Vue auto-escape template output
- DOM isn't what curl shows — SPA renders differently than raw HTML response
- Browser XSS Auditor — mostly deprecated but some edge cases remain
- Encoding breaks it — browser decodes differently than curl shows
- Context is wrong — payload reflects but not in an execution context
- WAF blocks the browser request — curl with the payload works, browser with the payload gets challenged
- HttpOnly cookies — XSS fires but can't steal cookies, reducing impact to lower severity