# Xss HTML Injection

> Execute comprehensive client-side injection vulnerability assessments on web applications to identify XSS and HTML injection flaws, demonstrate exploitation techniques for session hijacking and credential theft, and validate input sanitization and output encoding mechanisms.

- Skill: `newmindsgroup/xss-html-injection` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add newmindsgroup/xss-html-injection`
- Raw SKILL.md: https://api.skillmd.com/api/skills/newmindsgroup/xss-html-injection/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Web & Frontend
- License: MIT
- Author: newmindsgroup (https://skillmd.com/u/newmindsgroup)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/newmindsgroup/xss-html-injection

---


# Cross-Site Scripting and HTML Injection Testing

Execute comprehensive client-side injection vulnerability assessments on web applications to identify XSS and HTML injection flaws, demonstrate exploitation techniques for session hijacking and credential theft, and validate input sanitization and output encoding mechanisms.

## When to Use
- This skill is applicable to execute the workflow or actions described in the overview.

## Core Workflow
1. Confirm the request matches this skill's trigger, scope, and risk profile.
2. Use the topic map to identify the relevant pattern, checklist, or example before writing detailed guidance or code.
3. Load `references/full-guidance.md` when implementation details, examples, anti-patterns, validation checks, or edge cases are needed.
4. Apply only the relevant guidance instead of loading or repeating the entire reference by default.
5. Verify the result against any validation checks, limitations, security notes, or platform constraints in the reference.

## Topic Map
- Purpose
- Inputs / Prerequisites
- Required Access
- Technical Requirements
- Legal Prerequisites
- Outputs / Deliverables
- Core Workflow
- Phase 1: Vulnerability Detection
- Phase 2: Stored XSS Exploitation
- Phase 3: Reflected XSS Exploitation
- Phase 4: DOM-Based XSS Exploitation
- Phase 5: HTML Injection Techniques
- Phase 6: Filter Bypass Techniques
- Quick Reference
- XSS Detection Checklist
- Common XSS Payloads
- Cookie Theft Payload
- Session Hijacking Template

## Reference Map
- `references/full-guidance.md` preserves the complete original guidance, including examples and detailed edge cases.

## Progressive Loading
Keep this `SKILL.md` as the compact routing and workflow entrypoint. Load the reference file only when the user task requires the deeper implementation material.