DOMinator

DOMinator is a much more specialized choice: its focus is analyzing DOM-based XSS through runtime taint tracking rather than broadly scanning an application for every type of vulnerability. That makes it interesting for investigating JavaScript-driven XSS where the dangerous data flow only becomes apparent in the browser. We'd reach for it when DOM behavior itself is the thing we're trying to understand, although its age and explicit “not yet for production” warning make it more appropriate for research and lab work than a modern production assessment.