XSS discovery pipeline with WAF bypass — chains katana, dalfox, and wafw00f with DOM sink analysis and source map detection.