Scan Web Application Vulnerabilities
Run comprehensive vulnerability scans against web applications to identify security weaknesses.
Test for Cross-Site Scripting (XSS)
Detect XSS vulnerabilities where user input is reflected or stored without proper sanitization.
ToolCross-site scripting (XSS) lets attackers inject malicious scripts into web pages viewed by other users. A stored XSS vulnerability in a comment field, for example, can steal session cookies from every user who views the page. Reflected XSS in a search parameter can be weaponized through phishing links. Both types bypass same-origin policies and can lead to full account takeover.
The test_injection skill sends XSS payloads to application inputs and analyzes how the application handles them. It checks for reflected XSS in URL parameters and form submissions, stored XSS in persistent fields like comments and profiles, and DOM-based XSS in client-side JavaScript.
XSS is the most common web vulnerability, found in the majority of web applications that have not been specifically tested for it. Modern frameworks provide some built-in protection, but any place where user input is rendered without escaping is a potential XSS vector. Testing is the only way to know for sure that your output encoding and content security policies are working correctly.
Agent Guides
Claude
- Connect ToolRouter: claude mcp add toolrouter -- npx -y toolrouter-mcp
- Ask Claude: "Test this application for XSS vulnerabilities using pentest" and provide the URL
- Claude sends XSS payloads to input fields and analyzes responses
ChatGPT
- Configure ToolRouter in ChatGPT
- Ask: "Test my web application for XSS vulnerabilities" and provide the URL
- ChatGPT probes inputs and returns XSS findings
Copilot
- Add ToolRouter to Copilot MCP config
- In Copilot Chat: "Test my app for XSS vulnerabilities" and provide the URL
- Copilot runs XSS tests and returns vulnerable inputs
OpenClaw
- Connect ToolRouter: openclaw mcp add toolrouter -- npx -y toolrouter-mcp
- Ask OpenClaw: "Test this application for XSS vulnerabilities"
- OpenClaw probes inputs with XSS payloads
Related Use Cases
Test API Security
Assess the security of REST APIs by testing authentication, authorization, input validation, and injection resistance.
Check for SQL Injection Vulnerabilities
Test web applications and APIs for SQL injection vulnerabilities that could expose database contents.
Scan for Authentication Weaknesses
Test login systems, session management, and authentication flows for security weaknesses.