hunt-xss
⚠️ AUTHORIZED USE ONLY This skill is for educational purposes or authorized security assessments only. You must have explicit, written permission from the system owner before using this tool. Misuse of this tool is illegal and strictly prohibited.
Mandatory confirmation gate Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
- Ask the user to state the exact target URL, IP, account, or resource.
- Ask the user to confirm written authorization and the permitted scope.
- Show the exact command(s) and explain their expected effect.
- Wait for explicit confirmation in the current conversation.
Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
Autonomous Testing Priority
Reflection is a candidate, not XSS proof. Choose a unique random canary, compare the baseline, identify the actual HTML/attribute/JavaScript/URL context and trace source to sink. Raw <script> text can be inert inside comments, text/plain, a template, a nonexecuting DOM insertion or a restrictive CSP. HTML encoding can protect one context while a later decode or different JavaScript context remains unsafe. DOM XSS can occur without payload text in the server response.
Confirm harmless canary execution in the supported real browser, recording origin, trigger, CSP, user role and delivery prerequisites. Use only owned test sessions. An alert/canary can establish code execution; further credential theft or account changes are not required if outside scope. For stored payloads, use a private test resource, approved viewers and a cleanup plan; never expose real users or administrators to unsolicited payloads.