What problem does it solve? Testing login flows, OAuth redirects, session handling, and DOM-based vulnerabilities in JavaScript-heavy web applications is impossible with curl or Burp alone because they cannot maintain real browser state or execute client-side JavaScript. ## Core Features & Use Cases - Authentication Workflow Automation: Automate login sequences, save and reuse session state, and test MFA flows including bypass attempts via direct navigation. - Session & Cookie Analysis: Inspect Secure, HttpOnly, and SameSite cookie attributes, and audit localStorage/sessionStorage for exposed tokens and secrets. - Interactive Vulnerability Validation: Confirm DOM-based XSS, clickjacking, CSRF, and OAuth redirect manipulation with screenshots, console logs, and network captures as evidence. - Use Case: When a target SPA requires a multi-step login before any endpoint is reachable, use this Skill to authenticate via Playwright, save the storage state, then run authenticated scans and validate DOM XSS payloads that only execute in a real browser. ## Quick Start Use Playwright to log into the target application, save the session state, and test the session cookies for missing HttpOnly and SameSite flags.
