Map the XSS attack surface of a target URL. Analyze security headers, client-side frameworks, JavaScript patterns, and DOM structure to identify what makes XSS possible, easier, or harder.
This skill does NOT inject payloads or test for XSS. It performs passive observation only (HTTP requests + source analysis). For active XSS testing, use /xss-finder.
| Header Assessment | CSP, X-Content-Type-Options, cookie flags, charset | | Framework Detection | React, Angular, Vue, jQuery + version extraction | | Vulnerable Library Detection | Known CVEs per detected library version | | DOM XSS Source/Sink Mapping | innerHTML, eval, location.hash, postMessage |
Habilidad de reconocimiento de la superficie de ataque XSS: analiza encabezados, marcos, bibliotecas JS y patrones DOM en una URL para mapear qué hace que XSS sea posible o más difícil. Para hackers éticos que se preparan para las pruebas XSS. Fuente: igbuend/grimbard.