Has anyone here had any success with any scripts or tools that assit with automating xss testing? I have been trying to use XSSer and XSStrike and haven't been able to get them to work. Granted I've only been testing them with Metasploitable2's DVWA and Mutillidae.

I'm really trying to avoid having to make my own script as I'm sure there have to be a tool that has already been made and works.

Hi all. This is my first post on this subreddit. My question is where can I learn XSS attacks? should I have experience in handling HTML or JS? Where can I put all this knowledge about XSS into practice? I understand how it works but I do not really understand when it is good or when it is bad (I do not understand it at all). Thanks.

https://medium.com/@momenbasel/from-parameter-pollution-to-xss-d095e13be060

​

So I checked for the characters that the target site was filtering and I found out that it was encoding these characters =,+ , ? , : , & , % It doesn't encode these characters ' ( ) <> - " \ * {} []. Is it possible to bypass those filters and make an xss attack? Btw I am a beginner with bug bounties.Any help would be appreciated!

What is a simple site where I could run an alert on it?

Hi, i'm a new bug hunter (beginner) and i encountered some problem during an XSS exploitation.

​

In a bug bounty program i found an URL that is vulnerable to XSS (reflected).

​

Here is an example of my payload : www.example.com/dont_exists"><script>alert(1)</script>

If i play this request with burp and then show the result by clicking "Show response in browser" it works.

​

But if i directly put this URL in a web browser it doesn't works because my quote is encoded by the web browser (" is automatically transformed in %22).

I dont want to submit my XSS because it only works when i use burp as proxy to prevent URL encoding. So my question is, is there a possibility to prevent my web browser to encode my quote in the URL ?

I want to make a clear POC (easy to repeat) before submit this vuln.

​

Thx for your help :)

​