hunt-xss

Map every reflection point by spidering the target, then classify each as reflected, stored, or DOM-based. Probe sanitizer behavior with unique random canary strings, test SVG uploads and markdown renderers, and validate every finding in a real browser before reporting.

Plant out-of-band beacons using unique sub-tagged Collaborator subdomains in fields likely viewed later by admins, such as error messages, login usernames, User-Agent and Referer headers. A callback from a browser User-Agent confirms execution; encoded reflections or WAF rejections do not.

Common bypasses include mutation XSS via math+style or svg+style tag combinations, unquoted or backtick-delimited event handlers, HTML entity encoding of javascript: URLs, and exploiting incomplete sanitizer patches. SVG uploads often bypass CSP because image/svg+xml responses may not inherit the page policy.

Browser parsing differences, XSS auditors, and CSP enforcement can block payloads that appear valid in a proxy. Always validate in a current Chrome or Firefox build, and check whether the payload is HTML-encoded in the response, which indicates correct output escaping rather than a vulnerability.

Self-XSS that only fires in the attacker's own session, alert-only proofs without demonstrated impact, and reflections where the canary appears HTML-encoded are commonly rejected or downgraded. Demonstrate terminal impact such as session theft, token exfiltration, or account takeover before claiming High or Critical severity.