URL corpus → XSS candidates
Collect historical URLs, filter for reflected-XSS-shaped params, inject a marker, and scan with dalfox.
Level: intermediate
Tools: gau, gf, qsreplace, dalfox
Pipeline
gau {domain} | gf xss | qsreplace 'FUZZ' | dalfox pipe -o xss.txt