A friend messaged me that an XSS vulnerability was found in his website and that he wants me to take a further look. This is an important stage, as I am inclined to ask for him to formally express that I have his permission to perform a full test on his web application and on the server hosting it. The answer was positive.

The first move is always to enumerate and find as much information as you can about your enemy — while trying to alarm them as little as possible.