# Cross-Site Scripting and HTML Injection Testing

> This skill should be used when the user asks to "test for XSS vulnerabilities", "perform cross-site scripting attacks", "identify HTML injection flaws", "exploit client-side injection vulnerabilities", "steal cookies via XSS", or "bypass content security policies". It provides comprehensive techniques for detecting, exploiting, and understanding XSS and HTML injection attack vectors in web applications.

- Skill: `dokhacgiakhoa/cross-site-scripting-and-html-injection-testing` (Agent Skill, multi-file: 21 files)
- Install (CLI): `npx skillmds@latest add dokhacgiakhoa/cross-site-scripting-and-html-injection-testing`
- Raw SKILL.md: https://api.skillmd.com/api/skills/dokhacgiakhoa/cross-site-scripting-and-html-injection-testing/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Web & Frontend
- Author: Dokhacgiakhoa (https://skillmd.com/u/dokhacgiakhoa)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/dokhacgiakhoa/cross-site-scripting-and-html-injection-testing

---


# Cross-Site Scripting and HTML Injection Testing

## Purpose

Execute comprehensive client-side injection vulnerability assessments on web applications to identify XSS and HTML injection flaws, demonstrate exploitation techniques for session hijacking and credential theft, and validate input sanitization and output encoding mechanisms. This skill enables systematic detection and exploitation across stored, reflected, and DOM-based attack vectors.

## Inputs / Prerequisites

## 🧠 Knowledge Modules (Fractal Skills)

### 1. [Required Access](./sub-skills/required-access.md)
### 2. [Technical Requirements](./sub-skills/technical-requirements.md)
### 3. [Legal Prerequisites](./sub-skills/legal-prerequisites.md)
### 4. [Phase 1: Vulnerability Detection](./sub-skills/phase-1-vulnerability-detection.md)
### 5. [Phase 2: Stored XSS Exploitation](./sub-skills/phase-2-stored-xss-exploitation.md)
### 6. [Phase 3: Reflected XSS Exploitation](./sub-skills/phase-3-reflected-xss-exploitation.md)
### 7. [Phase 4: DOM-Based XSS Exploitation](./sub-skills/phase-4-dom-based-xss-exploitation.md)
### 8. [Phase 5: HTML Injection Techniques](./sub-skills/phase-5-html-injection-techniques.md)
### 9. [Phase 6: Filter Bypass Techniques](./sub-skills/phase-6-filter-bypass-techniques.md)
### 10. [XSS Detection Checklist](./sub-skills/xss-detection-checklist.md)
### 11. [Common XSS Payloads](./sub-skills/common-xss-payloads.md)
### 12. [Cookie Theft Payload](./sub-skills/cookie-theft-payload.md)
### 13. [Session Hijacking Template](./sub-skills/session-hijacking-template.md)
### 14. [Operational Boundaries](./sub-skills/operational-boundaries.md)
### 15. [Technical Limitations](./sub-skills/technical-limitations.md)
### 16. [Legal and Ethical Requirements](./sub-skills/legal-and-ethical-requirements.md)
### 17. [Example 1: Stored XSS in Comment Section](./sub-skills/example-1-stored-xss-in-comment-section.md)
### 18. [Example 2: Reflected XSS via Search Parameter](./sub-skills/example-2-reflected-xss-via-search-parameter.md)
### 19. [Example 3: DOM-Based XSS via Hash Fragment](./sub-skills/example-3-dom-based-xss-via-hash-fragment.md)
### 20. [Example 4: CSP Bypass via JSONP Endpoint](./sub-skills/example-4-csp-bypass-via-jsonp-endpoint.md)