<p><pre><code>    With delayed XSS testing, security engineers inject an XSS payload on one application that may get reflected back in a separate application with a different origin.
</code></pre>
No need to go beyond application scope. Most tools even fail to detect XSS if it is reflected not in the immediate response, but in a later response. They inject the XSS payload and check if the immediate HTTP response contains that very string. If not, <i>there&#x27;s no XSS.</i><p>Maybe Sleepy Puppy is a solution. You could now define some standard click-paths through your app with Selenium IDE and inject various payloads into every parameter. I didn&#x27;t take a deeper look in how Sleepy Puppy works, but automated workflow execution + payload injection + delayed XSS detection is what matters in modern complex web apps.