I'm desperately looking for tools, preferably with some guide, also preferably open-source, to detect stored xss vulnerabilities. It is observed that a handful of them doesn't give the expected results with stored XSS.
I have tried with ZAP Proxy and xsser, but only found documentation on reflected XSS for those tools.
For stored XSS the "injected" page may be different from the vulnerable page.
I'm benchmarking tools on a simple vulnerable app found here: https://hack.me/101061/persistent-xss.html
Manual exploitation took seconds, but so far I was not able to use automatic tools, even in a "guided" mode where I specify the URL of the form and let the tool find vulnerable pages.
I suspect that both cited tools are able to do that, but it's either too trivial or too complicated to be shown in examples/blog posts. I would be really grateful if someone could show such use case.