Is the xss me plugin the best option for testing xss attacks?

Question

JavaScript

Or are there other ways to test a site for vulnerabilities that are more accurate and professional?

Answer 1

it seems that it is not. it does not see forms that work on scripts, that is, on inputs outside the form tag and buttons with hung events. I'm also interested, but theoretically I don't see any universal way. if the form submission is organized in a non-standard way (form tag, post method, etc.), then it can be organized in any way, and this must be manually studied, where what is sent and what answers. if we are talking about your site, then you can issue a secret one-time token to each instance of the form, this is not ideal, but you can hack the automatic swotting to malefactors