Tracy

Tracy is an essential Chrome extension designed to assist penetration testers and security researchers in discovering all sinks and sources of input within modern web applications. It provides a detailed, digestible overview of potential cross-site scripting (XSS) vulnerabilities beyond traditional server-side reflection, including advanced attack vectors like DOM clobbering, frontend and backend template injections, and open redirects.

Unlike tools that only analyze server responses, Tracy grants you "X-ray vision into the DOM," revealing how frontend output encoding interacts with inputs to expose potential risks. By identifying and documenting every input source and follow-up sink, Tracy empowers users to effectively locate and mitigate complex XSS attack surfaces, making web applications safer and more secure.