A pentesting tool designed to assist with finding all sinks and sources of a web application and display these results in a digestible manner. tracy should be used during the mapping-the-application phase of the pentest to identify sources of input and their corresponding outputs. tracy can use this data to intelligently find vulnerable instances of XSS, especially with web applications that use lots of JavaScript.
tracy is a browser extension that records all user input to a web application and monitors any time those inputs are output, for example in a DOM write, server response, or call to eval.
Demo
To install Tracy add on in Firefox browser:
Use this addon URL
https://addons.mozilla.org/en-US/firefox/addon/tracyplugin/
Once Tracy is added in firefox, we can browse our target web application and find out potential source (input) and sink (execution point in DOM) to find out XSS based issues.