Why do I have to do manual XSS testing in addition to using tools such as Burp Suite/XXSer/Xenotix?

Question

At what point does manual testing for XSS come preferred to an automated attack like one through Burp Suite?

Looking through bug bounties and various exploits and it's not clear where there is a dividing line between manual and automatic discovery of XSS, if at all.

Does it come down to preference or are there payloads that one or the other can't handle?

I understand the need to comprehend XSS attacks is needed, but why can't automated tools do the legwork for us?

https://www.google.com/about/appsecurity/learning/xss/#HowToTest - seem reasonable?

Answer 1

That link is reasonable.

Why do you need to manually test for vulnerabilities? Because a tool it's just a tool someone else created and he might have forgot to add a possible payload. Don't know about any specific case though, although I'm not much on the "offensive" side nowadays.

So, if you are the developer, a good approach is to:

• Know where are you accepting input data.
• Integrate automatic testing of input filtering.
• Run any reliable tool to check for possible XSS.

On the other hand, if you are just black-box testing:

• Identify the possible input points.
• Run whatever tool you want.
• If you consider that the tool might have skipped something, manually check for it.

Answer 2

Automated tools are only as good as the people who made them (i.e. the test logic they contain and the rules/signatures they use). "Garbage In Garbage Out" as the old saying goes !

In pretty much all automated security testing tools I've used there have always been false positives and false negatives.

Therefore in order to ensure your test results are truthful, any serious penetration tester (or other security professional) will always undertake a degree of manual testing in order to validate what their automated tools are telling them, and to supplement what their automated tools can do.