Jikto is a Javascript tool that can take over your computer and use it to find sites with vulnerabilities. We describe it and the cross-site scripting flaws it looks for.