Question

XSS hunting can be time-consuming. You might spend hours inspecting different request parameters and never find any XSS. Fortunately, you can use tools to make your work more efficient.

XSS 搜索可能耗费很多时间。你可能会花费数小时检查不同请求参数，却始终找不到任何 XSS。幸运的是，你可以使用工具使你的工作更加高效。

First, you can use browser developer tools to look for syntax errors and troubleshoot your payloads. I also like to use my proxy’s search tool to search server responses for reflected input. Finally, if the program you are targeting allows automatic testing, you can use Burp intruder or other fuzzers to conduct an automatic XSS scan on your target. We will talk about this in Chapter 25 .

首先，你可以使用浏览器开发工具查找语法错误并排除你的有效载荷的问题。我也喜欢使用代理的搜索工具在服务器响应中搜索反射输入。最后，如果你针对的程序允许自动测试，你可以使用 Burp Intruder 或其他模糊测试工具对目标进行自动 XSS 扫描。我们将在第 25 章讨论。