Overview. There are many methods to detect XSS vulnerabilities: testing tools (e.g., black-box web vulnerability scanning tools), static analysis tools, and manual code review. Also, some web application frameworks support methods to avoid XSS.
Prevention is the best defense. The best first line of defense is to integrate security into your software development lifecycle. Train your developers about how to prevent XSS. Train them to use input validation on inputs, and appropriate output escaping on all values dynamically inserted into a HTML document.
If possible, choose a web application framework that provides context-sensitive auto-escaping for all values inserted into HTML. For more background, read my explanation elsewhere.
Remember, you can't test quality in after-the-fact. Developers need to own the problem of avoiding XSS. No one is perfect, so it can be helpful to perform some sort of quality assurance, to check for oversights and inadvertent bugs -- but do not accept an attitude that preventing XSS is primarily the responsibility of the testing team. It is not.
Black-box web vulnerability scanning tools.
Black-box web vulnerability scanning tools check for common vulnerabilities, like XSS, by spidering your website and sending carefully-crafted malicious inputs to your web application, to see how it handles those inputs. These tools can be used to find XSS vulnerabilities. (They are also sometimes called black-box web pentesting (penetration testing) tools.)
There are many offerings in this space, both commercial and open-source. There is a broad spectrum of approaches, from purely manual penetration testing (performed by pentesting experts), to entirely automated point-and-shoot vulnerability scanning tools, to hybrid services that include a combination of the two. For manual penetration testing, you can buy services from companies who specialize in this. You can also find services who will periodically perform a combination of automated and manual penetration testing and alert you of any new vulnerabilities (e.g., WhiteHat Security). Finally, black-box vulnerability scanners are typically intended to be used in an automated fashion -- though be warned, they output a list of warnings, and someone will need to review those warnings manually, as some of those warnings will be false alarms.
Effectiveness.
It is important to keep in mind that automated black-box vulnerability scanning tools find only a fraction of vulnerabilities. One recent research study found that automated black-box vulnerability scanning found only ~ 40% of the vulnerabilities in the application. Manual code review by a knowledgeable security expert found many vulnerabilities that black-box vulnerability scanning missed. Therefore, if you can afford to perform both black-box vulnerability scanning and manual code review, this will be more effective at detecting vulnerabilities in your web application.
Readings.
Here are two research papers that summarize the state of the art in this area:
See also the following non-academic white papers:
Also, this might be of interest:
Finally, you can find a lot of information about this topic on the Security.SE site:
and there is lots more I didn't include here; use the search tool on that site.
