xssdetect.js

var page = require('webpage').create(),
    system = require('system'),
    address;

page.onInitialized = function () {
    page.evaluate(function () {
        // additional detection code here perhaps
        // f.e. detecting STORED/DOM XSS

    });
};

page.settings.XSSAuditingEnabled = true;

// Route "console.log()" calls from within the Page context to the main Phantom context (i.e. current "this")
page.onConsoleMessage = function(msg) {
    if (msg.indexOf("Refused to execute a JavaScript script") == 0) {
        console.log("XSS!");
    }
};

if (system.args.length === 1) {
    console.log('Usage: xssdetect.js <some URL>');
    phantom.exit(1);
} else {
    address = system.args[1];
    console.log('Checking ' + address + '...');
    page.open(address, function (status) {
        if (status !== 'success') {
            console.log('FAIL to load the address');
        } else {
            window.setTimeout(function () {
                phantom.exit();
            }, 1500);
        }
    });
}