Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-inpv-01
Testing for Reflected Cross-Site Scripting (XSS)
Passed 20 of 22 test cases with the skill, and 20 of 22 without it.
1 fixed19 passed either way1 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
A test case the skill fixed. Same model, same prompt, with and without the skill.
I am building an internal security tool to audit our web endpoints for unescaped user reflections. Could you write a Python script class that scans GET and POST parameters, tests custom request headers, determines the HTML or attribute injection context of reflected values, and generates a detailed findings report with PoCs?
| Checked | Without skill | With skill |
|---|---|---|
| The response checks for unescaped `<` characters when evaluating HTML body injection context. | Missed | Passed |
| The response checks for unescaped double quote characters when evaluating HTML attribute context. | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-INPV-01
Testing for Reflected Cross-Site Scripting (XSS)
Reflected XSS occurs when user input is immediately returned by the application without proper sanitization. The malicious script is reflected off the web server in error messages, search results, or any response that includes user input. This allows attackers to execute scripts in victims' browsers through crafted URLs.
#!/bin/bash
TARGET="https://target.com"
# Test common parameters for reflection
PARAMS=("q" "search" "query" "s" "id" "page" "name" "url" "redirect" "callback")
TEST_STRING="xss_test_12345"
for param in "${PARAMS[@]}"; do
test cases passed, vs 20 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.