domains / families / security / hunt-xss

hunt-xss

combined

Hunting skill for xss vulnerabilities. Hunting skill for xss vulnerabilities. Built from 174 public bug bounty reports. Use when hunting xss on any target.

When to use

• You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.
• You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.
• ✅ Payload is REFLECTED/STORED in response (presence)
• ✅ Payload appears in a RENDERABLE context (sink check)
• ✅ Payload EXECUTES in browser (proof of exploitation)

When not to use

• Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.
• Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.
• Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.

Skill page

Conflict

The two copies share the same core structure (Crown Jewel Targets and the OOB-Or-It-Didn't-Happen Gate are nearly identical), but each contains material steps the other lacks. The uphiago copy provides a framework-specific sink verification table (React/Vue/Angular/Svelte/Next.js) and a grep command to check JS bundles for dangerous rendering patterns, which is a critical 'presence vs. exploitation' gate. The sickn33 copy provides a mandatory authorization confirmation gate, a unique numeric canary strategy to distinguish real payloads from decoys, and a specific ordered list of injection contexts (inline script, attribute event, URL/href). Crowning one would hide the other's unique verification and safety procedures.