js-xss.yaml

# info to search signature
id: fuzz-reflect-xss-in-js-code
type: fuzz
info:
  name: Reflect XSS in js code
  risk: High

# origin: gonna come from Burp
payloads:
    - aaa\"xssHere
    - aaa\'xssHere	
      
requests:
  - generators:
      # Change exist content type or adding new one
      - Query("{{.payload}}")
      - Path("{{.payload}}", "*")
    detections:
      - >-
        StringSearch("resBody", '"aaa"xssHere') && StatusCode() != 301 && StatusCode() != 302
      - >-
        StringSearch("resBody", "'aaa'xssHere") && StatusCode() != 301 && StatusCode() != 302