At what point does manual testing for XSS come preferred to an automated attack like one through Burp Suite?
Looking through bug bounties and various exploits and it's not clear where there is a dividing line between manual and automatic discovery of XSS, if at all.
Does it come down to preference or are there payloads that one or the other can't handle?
I understand the need to comprehend XSS attacks is needed, but why can't automated tools do the legwork for us?
https://www.google.com/about/appsecurity/learning/xss/#HowToTest - seem reasonable?