In the modern web, with heavy use of client side processing and security guards like WAFs and XSS-aware browsers, XSS exploitation became much more clever and dangerous as it was never before. In this talk we will see how to build modern and advanced XSS vectors and the scenarios involved to give rise to them. We will also see the use of webGun, a tool designed to help testers to build complex payloads to test them in live targets.