AI-Assisted XSS Hunting: Workflows for Claude and Cursor

The four-step AI-assisted XSS workflow

1. Surface inventory: ask Claude to enumerate every reflection point and DOM sink from a JS bundle.
2. Source-to-sink tracing: prompt for taint analysis across the bundle.
3. Sanitiser review: paste the sanitiser and ask for known bypasses + a custom mutation set.
4. CSP review: paste CSP and ask for the shortest payload that survives.

A copy-paste prompt chain

# Step 1 — inventory
You are an XSS specialist. Given the JS bundle below, list every value that reaches innerHTML, document.write, eval, setTimeout(string), location, srcdoc, or dangerouslySetInnerHTML. Output a table: sink | source | confidence | line.

# Step 2 — sanitiser bypass
Here is the sanitiser. Identify the parser quirks (mxss, mutation xss, namespace confusion, template parsing) it does not handle. Produce 10 payloads that bypass it, ordered by likelihood.

# Step 3 — CSP
CSP: <paste>. Produce the shortest valid payload that executes JS inside this policy. Show payload and explain which directive you abused.

Tips from real engagements

• Always have Claude show its taint chain — wrong chains are easy to spot.
• Ask for three payload families: HTML context, attribute context, JS string context.
• Pair with a headless browser PoC harness — Claude will write it if you ask.

FAQ