offensive-xss

Name: offensive-xss
Author: SnailSploit

2.8kstars447forks

How to install offensive-xss?

snailsploit/claude-red/offensive-xss

$npx -y skills add SnailSploit/Claude-Red --skill offensive-xss

Installs into the current project.

Summary

When this skill is active: 1. Load and apply the full methodology below as your operational checklist 2. Follow steps in order unless the user specifies otherwise 3. For each technique, consider applicability to the current target/context 4. Track which checklist items have been

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Cross-Site Scripting (XSS)
2
3	## Metadata
4	- Skill Name: xss
5	- Folder: offensive-xss
6	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/xss.md
7
8	## Description
9	Cross-Site Scripting testing checklist: stored/reflected/DOM/blind XSS discovery, polyglot payloads, CSP bypass, XSS filter bypass, event handler injection, DOM clobbering, mutation XSS, and impact escalation (session hijack, phishing, keylogging). Use for web app XSS testing and bug bounty.
10
11	## Trigger Phrases
12	Use this skill when the conversation involves any of:
13	`XSS, cross-site scripting, stored XSS, reflected XSS, DOM XSS, blind XSS, CSP bypass, XSS filter bypass, polyglot, DOM clobbering, mutation XSS, event handler injection`
14
15	## Instructions for Claude
16
17	When this skill is active:
18	1. Load and apply the full methodology below as your operational checklist
19	2. Follow steps in order unless the user specifies otherwise
20	3. For each technique, consider applicability to the current target/context
21	4. Track which checklist items have been completed
22	5. Suggest next steps based on findings
23
24	---
25
26	## Full Methodology
27
28	# Cross-Site Scripting (XSS)
29
30	## Shortcut
31
32	- Look for user input opportunities on the application. When user input is stored and used to construct a web page later, test the input field for stored XSS. if user input in a URL gets reflected back on the resulting web page, test for reflected and DOM XSS.
33	- Insert XSS payloads into the user input fields you've found. Insert payloads from lists online, a polyglot payload, or a generic test string.
34	- Confirm the impact of the payload by checking whether your browser runs your JavaScript code. Or in the case of a blind XSS, see if you can make the victim browser generate a request to your server.
35	- If you can't get any payloads to execute, try bypassing XSS protections.
36	- Automate the XSS hunting process
37	- Consider the impact of the XSS you've found: who does it target? How many users can it affect? And what can you achieve with it? Can you escalate the attack by using what you've found?
38
39	## Mechanisms
40
41	Cross-Site Scripting (XSS) is a vulnerability that allows attackers to inject malicious client-side scripts into web pages viewed by other users. XSS occurs when applications incorporate user-supplied data into a page without proper validation or encoding.
42
43	### Types of XSS
44
45	```mermaid
46	flowchart TD
47	A[Cross-Site Scripting] --> B[Stored XSS]
48	A --> C[Reflected XSS]
49	A --> D[DOM-Based XSS]
50	A --> E[Blind XSS]
51
52	B -->\|"Persists in DB"\| B1[Comments]
53	B -->\|"Persists in DB"\| B2[User Profiles]
54	B -->\|"Persists in DB"\| B3[Product Reviews]
55
56	C -->\|"Reflected in response"\| C1[Search Results]
57	C -->\|"Reflected in response"\| C2[Error Messages]
58	C -->\|"Reflected in response"\| C3[URL Parameters]
59
60	D -->\|"Client-side execution"\| D1[Client-side Routing]
61	D -->\|"Client-side execution"\| D2[DOM Manipulation]
62
63	E -->\|"Hidden Execution"\| E1[Admin Panels]
64	E -->\|"Hidden Execution"\| E2[Log Viewers]
65	```
66
67	#### Stored (Persistent) XSS
68
69	- Malicious script is permanently stored on target servers (databases, message forums, comment fields)
70	- Executed when victims access the stored content
71	- Most dangerous as it affects all visitors to the vulnerable page
72	- Examples: comments, user profiles, product reviews
73
74	```mermaid
75	sequenceDiagram
76	actor A as Attacker
77	participant W as Web Server
78	participant DB as Database
79	actor V as Victim
80
81	A->>W: Submit malicious script via form
82	W->>DB: Store user input with script
83	V->>W: Request page with stored content
84	W->>DB: Retrieve stored content
85	DB->>W: Return content with malicious script
86	W->>V: Deliver page with malicious script
87	Note over V: Script executes in victim's browser
88	V->>A: Stolen data sent to attacker
89	```
90
91	#### Reflected (Non-Persistent) XSS
92
93	- Script is reflected off the web server in an immediate response
94	- Typically delivered via URLs (parameters, search fields)
95	- Requires victim to click a malicious link or visit a crafted page
96	- Examples: search results, error messages, redirects
97
98	```mermaid
99	sequenceDiagram
100	actor A as Attacker
101	actor V as Victim
102	participant W as Web Server
103
104	A->>V: Send malicious URL
105	V->>W: Click link with malicious script in parameters
106	W->>V: Return page with reflected script
107	Note over V: Script executes in victim's browser
108	V->>A: Stolen data sent to attacker
109	```
110
111	#### DOM-Based XSS
112
113	- Vulnerability exists in client-side code rather than server-side
114	- Malicious content never reaches the server
115	- Occurs when JavaScript dynamically updates the DOM using unsafe methods
116	- Examples: client-side routing, client-side templating
117
118	```mermaid
119	sequenceDiagram
120	actor A as Attacker
121	actor V as Victim
122	participant W as Web Server
123	participant DOM as DOM
124
125	A->>V: Send malicious URL with fragment
126	V->>W: Request page (fragment not sent to server)
127	W->>V: Return page with JavaScript
128	Note over V: JavaScrip

People who liked this also viewed

6 picks

Type

offensive-xss

2.8kstars447forks

View on GitHub

How to install offensive-xss?

snailsploit/claude-red/offensive-xss

$npx -y skills add SnailSploit/Claude-Red --skill offensive-xss

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Cross-Site Scripting (XSS)
2
3	## Metadata
4	- Skill Name: xss
5	- Folder: offensive-xss
6	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/xss.md
7
8	## Description
9	Cross-Site Scripting testing checklist: stored/reflected/DOM/blind XSS discovery, polyglot payloads, CSP bypass, XSS filter bypass, event handler injection, DOM clobbering, mutation XSS, and impact escalation (session hijack, phishing, keylogging). Use for web app XSS testing and bug bounty.
10
11	## Trigger Phrases
12	Use this skill when the conversation involves any of:
13	`XSS, cross-site scripting, stored XSS, reflected XSS, DOM XSS, blind XSS, CSP bypass, XSS filter bypass, polyglot, DOM clobbering, mutation XSS, event handler injection`
14
15	## Instructions for Claude
16
17	When this skill is active:
18	1. Load and apply the full methodology below as your operational checklist
19	2. Follow steps in order unless the user specifies otherwise
20	3. For each technique, consider applicability to the current target/context
21	4. Track which checklist items have been completed
22	5. Suggest next steps based on findings
23
24	---
25
26	## Full Methodology
27
28	# Cross-Site Scripting (XSS)
29
30	## Shortcut
31
32	- Look for user input opportunities on the application. When user input is stored and used to construct a web page later, test the input field for stored XSS. if user input in a URL gets reflected back on the resulting web page, test for reflected and DOM XSS.
33	- Insert XSS payloads into the user input fields you've found. Insert payloads from lists online, a polyglot payload, or a generic test string.
34	- Confirm the impact of the payload by checking whether your browser runs your JavaScript code. Or in the case of a blind XSS, see if you can make the victim browser generate a request to your server.
35	- If you can't get any payloads to execute, try bypassing XSS protections.
36	- Automate the XSS hunting process
37	- Consider the impact of the XSS you've found: who does it target? How many users can it affect? And what can you achieve with it? Can you escalate the attack by using what you've found?
38
39	## Mechanisms
40
41	Cross-Site Scripting (XSS) is a vulnerability that allows attackers to inject malicious client-side scripts into web pages viewed by other users. XSS occurs when applications incorporate user-supplied data into a page without proper validation or encoding.
42
43	### Types of XSS
44
45	```mermaid
46	flowchart TD
47	A[Cross-Site Scripting] --> B[Stored XSS]
48	A --> C[Reflected XSS]
49	A --> D[DOM-Based XSS]
50	A --> E[Blind XSS]
51
52	B -->\|"Persists in DB"\| B1[Comments]
53	B -->\|"Persists in DB"\| B2[User Profiles]
54	B -->\|"Persists in DB"\| B3[Product Reviews]
55
56	C -->\|"Reflected in response"\| C1[Search Results]
57	C -->\|"Reflected in response"\| C2[Error Messages]
58	C -->\|"Reflected in response"\| C3[URL Parameters]
59
60	D -->\|"Client-side execution"\| D1[Client-side Routing]
61	D -->\|"Client-side execution"\| D2[DOM Manipulation]
62
63	E -->\|"Hidden Execution"\| E1[Admin Panels]
64	E -->\|"Hidden Execution"\| E2[Log Viewers]
65	```
66
67	#### Stored (Persistent) XSS
68
69	- Malicious script is permanently stored on target servers (databases, message forums, comment fields)
70	- Executed when victims access the stored content
71	- Most dangerous as it affects all visitors to the vulnerable page
72	- Examples: comments, user profiles, product reviews
73
74	```mermaid
75	sequenceDiagram
76	actor A as Attacker
77	participant W as Web Server
78	participant DB as Database
79	actor V as Victim
80
81	A->>W: Submit malicious script via form
82	W->>DB: Store user input with script
83	V->>W: Request page with stored content
84	W->>DB: Retrieve stored content
85	DB->>W: Return content with malicious script
86	W->>V: Deliver page with malicious script
87	Note over V: Script executes in victim's browser
88	V->>A: Stolen data sent to attacker
89	```
90
91	#### Reflected (Non-Persistent) XSS
92
93	- Script is reflected off the web server in an immediate response
94	- Typically delivered via URLs (parameters, search fields)
95	- Requires victim to click a malicious link or visit a crafted page
96	- Examples: search results, error messages, redirects
97
98	```mermaid
99	sequenceDiagram
100	actor A as Attacker
101	actor V as Victim
102	participant W as Web Server
103
104	A->>V: Send malicious URL
105	V->>W: Click link with malicious script in parameters
106	W->>V: Return page with reflected script
107	Note over V: Script executes in victim's browser
108	V->>A: Stolen data sent to attacker
109	```
110
111	#### DOM-Based XSS
112
113	- Vulnerability exists in client-side code rather than server-side
114	- Malicious content never reaches the server
115	- Occurs when JavaScript dynamically updates the DOM using unsafe methods
116	- Examples: client-side routing, client-side templating
117
118	```mermaid
119	sequenceDiagram
120	actor A as Attacker
121	actor V as Victim
122	participant W as Web Server
123	participant DOM as DOM
124
125	A->>V: Send malicious URL with fragment
126	V->>W: Request page (fragment not sent to server)
127	W->>V: Return page with JavaScript
128	Note over V: JavaScrip

People who liked this also viewed

6 picks

Type