[ ] subfinder -d “example.com” > subdomains.txt
[ ] cat subdomains.txt | httpx -duc -silent -nc -sc -title -td -cl -ct | sort -t'[' -k3,3nr | unew -el -i livesubdomains.txt
[ ] naabu -list livesubdomains.txt > naabu.txt
[ ] echo "example.com" | waymore -mode U -lr 3 -lcc 3 -f --stream | unew urls.txt
[ ] Single URL: echo "https://www.example.com" | katana -duc -silent -nc -jc -concurrency 10 -parallelism 10 -depth 7 -timeout 30 -aff | unew urls.urls
[ ] Multiple URL: cat httpx.txt | katana -duc -silent -nc -jc -concurrency 10 -parallelism 10 -depth 7 -timeout 30 -aff | unew urls.txt
[ ] Single URL-echo “https://example.com” | jscrawler
[ ] Mutiple URLcat urls.txt | jscrawler
[ ] cat jslinks.txt | secyra
[ ] cat jslinks.txt | httpx -duc -silent | jsluice urls | jq -r '.url' | unew | secyr

VULNERABILITY CHECKLIST:

[ ] Reflected — returned immediately in the HTTP response
[ ] Stored — saved server-side and rendered later (e.g., comments, profile fields)
[ ] DOM-based — processed client-side via JavaScript (innerHTML, document.write, location.hash, etc.)

XSS

[ ] identify Reflected XSS or Stored XSS

Step:1
- Inject a unique keyword- rix5uni  check if this keyword is reflecting -then we can try refelcted XSS , HTML injection and SSTI
- Click View page source and the sever reflects input in the HTTP resposne.

Step:2
- **Goal is to** confirm the input reaches the response -before testing for filtering behavior.

Step:3
- Inject a payload tix5uni”><script> to see what is filtering combining with <img> act accordingly.
- If special characters appears in the output - like lt&gt, that means endpoint is not vulnerable  move on to next parameter use tools like cewl ,x8 and wget to find hidden parameters

Step:4
- Tag & Keyword Filter Bypass (Case Variation)
- if <script> or  <img> tag is stripped , then try case variations

<ScRiPt>
<ImG SrC=x>
<SvG OnLoad=...>
<sCrIpT>alert(1)</sCrIpT>

Step:5
- If certain tags are blocked entirely, try alternative <svg> <body onload> etc

Step:6
- Function Testing
- Once a tag/event handler successfully executes, determine which JavaScript functions are permitted:

alert(1)
confirm(1)
prompt

Step:7
- Try Encoded Payloads
- If direct function names are blocked try  via encoding
- Link- <https://github.com/rix4uni/xss-payloads-generator>