hunt-xss
Installation
SKILL.md
When to Use
Use when the target has any endpoint where user input is reflected in HTML output, processed by a JavaScript framework, or stored for later display. XSS is the foundational client-side vulnerability class — it enables session hijacking, data theft, phishing, and account takeover. Every form, search field, URL parameter, file upload, and user-controlled field is a candidate. Highest-value targets: admin panels, OAuth sign-in pages, markdown/wiki renderers, email templates, file upload endpoints (SVG/HTML), and help/documentation sites with looser security posture.
⚠️ CRITICAL: Presence ≠ Exploitation
Reflection of HTML tags does NOT mean XSS is exploitable. Modern frameworks escape text by default. Before calling a finding XSS, you MUST verify the sink:
| Framework | Default Behavior | XSS Possible Only With |
|---|---|---|
| React/JSX | Escapes all text | dangerouslySetInnerHTML, innerHTML on refs |
| Vue | Escapes {{ }} |
v-html directive |
| Angular | Escapes {{ }} |
[innerHTML] binding |
| Svelte | Escapes { } |
{@html} tag |
| Next.js RSC | Escapes JSX text | dangerouslySetInnerHTML in components |
| Plain HTML/JS | Does NOT escape | innerHTML, document.write(), eval() |