Exploiting XSS with XSS Validator

XSS is already detected by various tools such as Burp and Acunetix; XSS Validator comes in handy. It is a Burp intruder extender that has been designed to automatically validate XSS vulnerabilities.

XSS Validator is based on SpiderLabs' blog post:
http://blog.spiderlabs.com/2013/02/server-site-xss-attack-detection-with-modsecurity-and-phantomjs.html

Getting ready

To use the tool in the following recipe, we will need to have SlimerJS and PhantomJS installed on our machines. Let's look at their installation on Kali:

1. We download both of the PhantomJS files from the internet using wget:

sudo wget https://bitbucket.org/ariya/phantomjs/downloads/phantomjs-1.9.8-linux-x86_64.tar.bz2

...