XSS Attack Surface Reconnaissance

Map the XSS attack surface of a target URL. Analyze security headers, client-side frameworks, JavaScript patterns, and DOM structure to identify what makes XSS possible, easier, or harder.

This skill does NOT inject payloads or test for XSS. It performs passive observation only (HTTP requests + source analysis). For active XSS testing, use /xss-finder.

Target: $ARGUMENTS (URL to analyze)

When to Use This Skill

• Before running /xss-finder — understand what defenses exist
• Scoping an XSS engagement — identify highest-value test targets
• Evaluating a site's XSS posture without active testing
• Mapping client-side technology stack for exploit development
• Identifying which XSS classes (reflected, stored, DOM) are most likely

Core Capabilities

| Capability | Description |