With delayed XSS testing, security engineers inject an XSS payload on one application that may get reflected back in a separate application with a different ori

With delayed XSS testing, security engineers inject an XSS payload on one application that may get reflected back in a separate application with a different origin. No need to go beyond application scope. Most tools even fail to detect XSS if it is reflected not in the immediate response, but in a later response. They inject the XSS payload and check if the immediate HTTP response contains that very string. If not, there's no XSS. Maybe Sleepy Puppy is a solution. You could now define some standard click-paths through your app with Selenium IDE and inject various payloads into every parameter. I didn't take a deeper look in how Sleepy Puppy works, but automated workflow execution + payload injection + delayed XSS detection is what matters in modern complex web apps.