Project-Foxhound

I downloaded Project Foxhound and added a plugin to it so it’s not too geeky. I went to try out directsponsor.net and it immediately found vulnerabilities on the fundraiser’s page
https://foxhound.ias.tu-bs.de/archives/foxhound_linux_1bb8dbd6bb1b9ecf23775599caf43f09dd882265.zip

What Foxhound actually does (simply)

It watches as JavaScript runs on a page and tracks whether user-controlled data (e.g., the URL hash #something, query strings, or cookies) ever flows into a dangerous place (e.g. innerHTML, eval()). If it does, that’s potentially an XSS vulnerability. It reports these automatically — you don’t have to find them manually.

Best starting points (in order)

SAP Community blog post — the most readable non-technical intro: https://community.sap.com/t5/technology-blog-posts-by-sap/project-foxhound-on-the-scent-of-client-side-web-vulnerabilities/ba-p/14272605
The browser extension — install this in Foxhound and you get a visual panel showing taint reports without needing to write any code. Much better than staring at the console: https://github.com/m10x/project-foxhound-taint-flow-extension
Test it on a purpose-built demo site — the example everyone uses to verify it works: https://domgo.at/cxss/example/1?payload=abcd&sp=x#12345 Open this in Foxhound with the extension running and you should see a taint report fire immediately, showing the #12345 hash flowing into innerHTML.
The wiki page on observing flows (if you want to go deeper): https://github.com/SAP/project-foxhound/wiki/Observing-Taint-Flows

The extension and the domgo.at demo is the quickest way to see it doing something concrete. After that the blog post gives you the “why” in accessible language.

So… another cool tool to have around! The plug-in just saves you having to flail around in the console; it alerts with a flag when it sees stuff, and you click it to get a nice formatted report

It’s an .xpi you can import into the extensions thing in Foxhound.
https://github.com/m10x/project-foxhound-taint-flow-extension/releases