ABSTRACT. The paper presents the results of the study and a mathematical model of the testing technology for vulnerability to one of the most common types of attacks on Web applications – XSS (Cross Site Scripting) – XSS DOM. Cross-site scripting is an error validation of user data, which allows you to send JavaScript code to be executed in the user's browser. Attacks of this kind are often also referred to as HTML injection, because the mechanism of their implementation is very similar to SQL injection, but unlike the latter, the introduced code is executed in the user's browser. The approach of mathematical modeling based on GERT networks is argued. Studies have shown that GERT (Graphical Evaluation and Review Technique) is a method of studying and analysis of stochastic networks that are used to describe the logical relationship between parts of the project or stages of the process. The main purpose of GERT is to evaluate the logic of the network and the duration of activity and reception of the conclusion about necessity of execution of some activities. A mathematical model of the testing technology of Web applications is developed. As the basis of the mathematical modeling the approach of GERT-network synthesis was taken. The developed mathematical model of testing technologies of DOM XSS vulnerability differs from the known by accounting of performance or analyzing the DOM structure. The developed mathematical model can be used when testing the vulnerability of a Web application.