vulns.co
/
GKData.io MCP

XSS hunting

Find every reflection, name the context, then execute. XSS is a gadget until it reads a session, a token, or an admin UI.

Skill: JavaScript and client trust

Ask: Which source reaches which sink, and which of those sinks is behind an origin check?

Stop: You have line numbers for the listener or sink, and you have not claimed execution from a pattern match.

Open the skill

Practice the class in the browser: PortSwigger Web Security Academy. The lab is theirs. This page is the stop condition and the disclosures.

Checklists

  • JavaScript review - Treat the frontend as source. Most P1s on modern apps start here.
  • XSS - Marker first. Context second. Execute third. Cookie/CSP last.

Disclosures

Playbooks

  • Advanced JavaScript Analysis - Turn shipped JavaScript into a bounded, evidence-led map of client attack paths: collect only in-scope artifacts, recover source where exposed, trace controllable data to real sinks or authorization decisions, then validate the smallest safe chain.
  • SPA / Next.js / React Hunting - The HTML is a shell. Routes, server actions, and /_next/data are the app.

Tools

  • jsluice - Extracts URLs, paths, and secrets from JavaScript by parsing the AST (not regex) - far more accurate than LinkFinder for modern bundles.
  • xnLinkFinder - Pulls links and possible parameter names out of a local file, a saved response, or a URL list. Point it at JavaScript or a HAR you already collected instead of crawling a live host.
  • sourcemapper - Downloads and reconstructs original source from a .js.map. Turns a minified bundle into a readable tree for sink hunting.

Payloads

  • Cross-Site Scripting (XSS) - Context-driven: pick by where your input lands. Start with a benign marker (vulnsXSS) to find reflection, then break the context - HTML body, attribute, JS string, URL, or SVG. Last entries are common WAF/filter bypasses.

Bypasses

  • XSS bypass (by sink) - Modern frameworks (React/Angular/Vue) auto-escape text, so the wins are unescaped attribute/href/src sinks, dangerous APIs, and framework-specific gadgets. Pick by where your input lands and what's filtered.

Questions

Is alert() enough?

For a self-XSS on your own profile, usually not. Show a session, a token in storage, or an admin-only render with a victim account you own.

Does CSP kill the finding?

Only if it actually blocks your payload. Parse the policy. Error pages and JSONP on allowed hosts are the usual way CSP fails.

This page is the linked pack hunt_brief("xss") returns on the MCP connector. Authorized testing only.