One problem with automated and semi-automated solutions for XSS is distinguishing signal from noise. To do that, a useful Burp plugin, XSS Validator, runs a PhantomJS-powered web server to receive the results of Burp queries and looks for a string injected into the alert() call embedded within the applied XSS snippets. It provides a clean way of culling the results of your XSS submissions to absolute confirmed vulnerabilities.
The easiest way to download the XSS Validator Burp extension is through the Bapp store. Just navigate to the store from the Extension tab within Burp Suite and select the extension from the marketplace (needless to say, it's free). You can also install the extension manually by following ...
