Skill · em Proteger

Cross-Site Scripting and HTML Injection Testing

This skill should be used when the user asks to "test for XSS vulnerabilities", "perform cross-site scripting attacks", "identify HTML injection flaws", "exploit client-side injection vulnerabilities", "steal cookies via XSS", or "bypass content security policies". It provides comprehensive…

Procedência

Antes de instalar

1 arquivo · 13 KB · só texto, nenhum script

Instalar na sua CLI

O comando baixa a versão fixada (commit 57f899e) direto da origem, para a pasta que a CLI lê. Precisa de curl (macOS e Linux); no Windows não há comando, porque o Rook Labs é para macOS.

Claude Code

Neste projeto: O name desta skill (“Cross-Site Scripting and HTML Injection Testing”) não segue o padrão das CLIs (minúsculas e hífens, igual ao nome da pasta): instalada assim, a CLI pode ignorá-la.

Global: O name desta skill (“Cross-Site Scripting and HTML Injection Testing”) não segue o padrão das CLIs (minúsculas e hífens, igual ao nome da pasta): instalada assim, a CLI pode ignorá-la.

Codex

Neste projeto: O name desta skill (“Cross-Site Scripting and HTML Injection Testing”) não segue o padrão das CLIs (minúsculas e hífens, igual ao nome da pasta): instalada assim, a CLI pode ignorá-la.

Global: O name desta skill (“Cross-Site Scripting and HTML Injection Testing”) não segue o padrão das CLIs (minúsculas e hífens, igual ao nome da pasta): instalada assim, a CLI pode ignorá-la.

Antigravity

Neste projeto: O name desta skill (“Cross-Site Scripting and HTML Injection Testing”) não segue o padrão das CLIs (minúsculas e hífens, igual ao nome da pasta): instalada assim, a CLI pode ignorá-la.

Global: O name desta skill (“Cross-Site Scripting and HTML Injection Testing”) não segue o padrão das CLIs (minúsculas e hífens, igual ao nome da pasta): instalada assim, a CLI pode ignorá-la.

Peça ao Rook

Já usa o Rook Labs? Cole no chat do Rook: instale a skill https://rooklabs.sh/marketplace/cct.cross-site-scripting-and-html-injection-testing

Prévia do SKILL.md

---
name: Cross-Site Scripting and HTML Injection Testing
description: This skill should be used when the user asks to "test for XSS vulnerabilities", "perform cross-site scripting attacks", "identify HTML injection flaws", "exploit client-side injection vulnerabilities", "steal cookies via XSS", or "bypass content security policies". It provides comprehensive techniques for …
metadata:
  author: zebbern
  version: "1.1"
---

# Cross-Site Scripting and HTML Injection Testing

## Purpose

Execute comprehensive client-side injection vulnerability assessments on web applications to identify XSS and HTML injection flaws, demonstrate exploitation techniques for session hijacking and credential theft, and validate input sanitization and output encoding mechanisms. This skill enables systematic detection and …

## Inputs / Prerequisites

### Required Access
- Target web application URL with user input fields
- Burp Suite or browser developer tools for request analysis
- Access to create test accounts for stored XSS testing
- Browser with JavaScript console enabled

### Technical Requirements
- Understanding of JavaScript execution in browser context
- Knowledge of HTML DOM structure and manipulation
- Familiarity with HTTP request/response headers
- Understanding of cookie attributes and session management

### Legal Prerequisites
- Written authorization for security testing
- Defined scope including target domains and features
- Agreement on handling of any captured session data
- Incident response procedures established

## Outputs / Deliverables

- XSS/HTMLi vulnerability report with severity classifications
- Proof-of-concept payloads demonstrating impact
- Session hijacking demonstrations (controlled environment)
- Remediation recommendations with CSP configurations
…

Ver todo o marketplace