Open folder
Open the project folder in the chat window.
Workflows
xss testing workflow
03
Check your staging copy
Open your project folder and ask the agent to find where user text enters the page. It reads the code, edits the file to add encoding, and checks the headers. It also reads your code for queries built by joining strings and suggests parameterised ones for you to review, answering questions like when parameterized queries fail sql injection.
Find inputs
Ask the agent to find user inputs in the code.
Apply fix
Review the diff and accept the encoding change.
Check headers
Verify the security headers on the staging site.
Test plan example
Execute the injection test plan on the staging copy.
- read_file
injection-test-plan.txt12 lines - grep
grep -r "SELECT.*FROM3 matches - Shell
run testsexit 0 - http_get
status check200 ok
waiting for your OK before the next stepRejectAccept
injection-test-plan.txt
# Comment: Staging copy test plan
# Comment: Use fake data only
Test 1: Search box input
Input: A surname with an apostrophe
Expect: Page works, no error
Test 2: Long text input
Input: Very long text string
Expect: Page works, no error
Test 3: Empty input
Input: Just press enter
Expect: Page works, no errorA plain-language input test plan for a staging copy of your own app. It lists harmless inputs and expected results without using attack strings.
owasp penetration testing walkthrough
Find and fix
The agent uses grep to find lines where user text is joined into HTML and suggests an edit_file change to wrap the text in a safe output function. Review the diff. You see a diff card showing the exact change clearly. In Ask first mode, you review the diff and click accept. The agent then runs your unit tests using the Shell tool to confirm the fix works. You verify the result by checking the page output in your browser. This approach helps you address common issues found during cross-site scripting testing by focusing on your code structure. Many developers seek dom xss learning resources, while owasp penetration testing ensures every change is validated before deployment.
Check headers
The agent uses http_get to fetch your staging page and reads the Content-Security-Policy header details carefully so you can verify the policy settings. Check the value. Use web_search to find the official documentation for your framework. Then use http_get to read that documentation page to ensure you understand the requirements. Ensure you are using the right settings for owasp testing. The agent shows the header details in a card for review. Handling xss during framework migration requires careful verification of these headers. Review the output and decide if the policy fits your needs.
