SKILL: Cross-Site Scripting (XSS)

Metadata

• Skill Name: xss
• Folder: offensive-xss
• Source: https://github.com/SnailSploit/offensive-checklist/blob/main/xss.md

Description

Cross-Site Scripting testing checklist: stored/reflected/DOM/blind XSS discovery, polyglot payloads, CSP bypass, XSS filter bypass, event handler injection, DOM clobbering, mutation XSS, and impact escalation (session hijack, phishing, keylogging). Use for web app XSS testing and bug bounty.

Trigger Phrases

Use this skill when the conversation involves any of:
XSS, cross-site scripting, stored XSS, reflected XSS, DOM XSS, blind XSS, CSP bypass, XSS filter bypass, polyglot, DOM clobbering, mutation XSS, event handler injection

Instructions for Claude

When this skill is active:

1. Load and apply the full methodology below as your operational checklist
2. Follow steps in order unless the user specifies otherwise
3. For each technique, consider applicability to the current target/context
4. Track which checklist items have been completed
5. Suggest next steps based on findings

----------- | -------------------------------------------------------------------------------------------- | ------------------------------------------------------------------- |
| React 19 | dangerouslySetInnerHTML, use() hook with unsanitized data, concurrent rendering races | Hydration mismatch bugs, useFormStatus edge cases |
| Vue 3.4+ | v-html, dynamic component names (:<is="...">), v-html with Composition API refs | Server-side rendering XSS in renderToString` |
| Svelte 5 | {@html ...}, runes ($state, $derived) with HTML content, event directives | Fine-grained reactivity can bypass sanitization |
| Next.js 15 | next/script strategy="beforeInteractive", Server Actions with unvalidated input, edge gaps | Turbopack dev server XSS (CVE-2024-XXXXX), RSC serialization issues |
| Solid 2.0 | innerHTML in reactive statements, <Dynamic> component with user props | Signal-based XSS when reactivity wraps unsafe HTML |
| Astro 4.x | set:html in .astro components, framework islands with unescaped props | Server-side XSS in content collections |
| Qwik | dangerouslySetInnerHTML equivalent, resumability serialization issues | Hydration boundary XSS |
| Remix 2.x | Loader data XSS, <Scripts/> with inline data, Form action injection | Deferred loader data without sanitization |
| Angular 17 | bypassSecurityTrust* methods, [innerHTML] binding, custom element XSS | SSR hydration mismatch, signal-based XSS |

Detection & Monitoring (AI‑assisted)