XSS
Cross-Site Scripting
0 / 7 solved
Make a page run your code in someone else's browser.
Quick reference
XSS cheat sheet
A quick workflow for finding places where your input reaches HTML, attributes, JavaScript, or the DOM.
Where to look
- Search boxes, error messages, profile fields, comments, guestbooks, support tickets, and URL parameters.
- Check query strings, URL fragments (#...), form fields, JSON values, and anything later rendered back into the page.
- Use DevTools or Burp to see whether the value is reflected in the response or inserted later by JavaScript.
Simple checks
- Start with a unique marker such as xsstest123 and find where it appears.
- Then test whether HTML characters are encoded or interpreted.
- Try payloads appropriate to the context rather than pasting the same payload everywhere.
<b>xss</b><img src=x onerror=alert(1)>"><svg onload=alert(1)>Realistic approach
- Reflected XSS: send a value and check the immediate HTTP response.
- Stored XSS: submit content, then revisit the page or another user/admin view.
- DOM XSS: inspect JavaScript sinks such as innerHTML, insertAdjacentHTML, document.write, or unsafe URL handling.
- A popup is only proof-of-concept; the real bug is untrusted data reaching an executable browser context.