Add an 'indication' element

[psiinon]

Another optional one, but one that tools can use to indicate the string that they identified which indicates the problem.
This can help the user sanity check the vulnerability.

[dancornell]

Would this be like the payload that was used to exploit a dynamic vulnerability?

[psiinon]

No, although thats useful to include as well :)
So the payload could be: <script>alert(1);</script>
while the indication (ie whats in the resulting page) would probably be: <script>alert(1);</script>

I use that in ZAP to highlight the relevant part of the response - a user can then look at that and hopefully more easily make a better judgement as to whether its a false positive or not.

[psiinon]

Typical - github translated my payloads and indications!
So the payload was an encoded version of the std basic script attack.
Lets try again...
Payload:

<script>alert(1)&#x3B;</script>

Indication:

 <script>alert(1);</script>