I am looking to PEN test my application against XSS attacks. The application is a REST API... As such when you POST some JSON to /cart/add to see the result of that attack you would need to GET ...
I'm setting up a reverse proxy to limit access to a protected resource. The protected resource provides a status page (http://protected.local/info). That page contains a number of links with query ...