# Xss Pentesting > Cross-Site Scripting (XSS) vulnerability testing and exploitation. Use this skill whenever the user mentions XSS, cross-site scripting, web security testing, JavaScript injection, reflected XSS, stored XSS, DOM XSS, WAF bypass, or any web application security assessment involving script injection. Make sure to use this skill for any XSS-related testing, payload crafting, or vulnerability analysis. - Skill: `abelrguezr/xss-pentesting` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add abelrguezr/xss-pentesting` - Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/xss-pentesting/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: abelrguezr (https://skillmd.com/u/abelrguezr) - Updated: 2026-09-10 - Page: https://skillmd.com/skills/abelrguezr/xss-pentesting --- # XSS Pentesting Skill A systematic approach to finding and exploiting Cross-Site Scripting vulnerabilities in web applications. ## Quick Start Methodology 1. **Find controllable input** - Check parameters, path, headers, cookies for reflection 2. **Identify the context** - Raw HTML, HTML attribute, JavaScript code, or DOM 3. **Craft the payload** - Based on context and any filters in place 4. **Test and iterate** - Try bypasses if initial payloads are blocked ## Step 1: Find Reflected Values Look for user-controlled data being reflected in the page: - **URL parameters**: `?search=` - check if `` appears in response - **POST data**: Form fields, JSON bodies - **Path segments**: `/profile/` - **Headers**: User-Agent, Referer, Custom headers - **Cookies**: Set a cookie and check if it appears in page source **Test payload**: `` or `"` - unique strings that are easy to find ## Step 2: Identify the Context ### Raw HTML Context Your input appears directly in the HTML body. **Test**: Send `

` **If it works**: You have a basic XSS. Try more advanced payloads below. ### HTML Attribute Context Your input is inside an attribute value like `value=""` or `href=""` **Test**: Send `" onmouseover="alert(1)` - try to break out of the attribute **If you can't break out**: Check if the attribute supports JavaScript (href, src, action, formaction) ### JavaScript Context Your input is inside `