Map the XSS attack surface of a target URL. Analyze security headers, client-side frameworks, JavaScript patterns, and DOM structure to identify what makes XSS possible, easier, or harder.
This skill does NOT inject payloads or test for XSS. It performs passive observation only (HTTP requests + source analysis). For active XSS testing, use /xss-finder.
| Header Assessment | CSP, X-Content-Type-Options, cookie flags, charset | | Framework Detection | React, Angular, Vue, jQuery + version extraction | | Vulnerable Library Detection | Known CVEs per detected library version | | DOM XSS Source/Sink Mapping | innerHTML, eval, location.hash, postMessage |
Abilità di ricognizione per la superficie di attacco XSS: analizza intestazioni, framework, librerie JS e modelli DOM in un URL per mappare ciò che rende XSS possibile o più difficile. Per gli hacker etici che si preparano ai test XSS. Fonte: igbuend/grimbard.