xss-detection

name	xss-detection
description	Detect reflected, stored, and DOM-based cross-site scripting vulnerabilities
domain	web-security
subdomain	xss
tags	["web","xss","injection","client-side"]
version	1.0.0
author	BerkahKarya
license	MIT

XSS Detection

When to use

Apply this skill when testing web applications for cross-site scripting (XSS) vulnerabilities.

Detection steps

1. Identify input vectors: URL parameters, form fields, HTTP headers (User-Agent, Referer), JSON body fields, and fragment identifiers.
2. Inject benign markers: Submit a unique alphanumeric string (e.g. xssprobe123) and observe where it appears in the response.
3. Test reflection contexts:
   • HTML body: <script>alert(1)</script>
   • Attribute: " onfocus="alert(1)
   • JavaScript string: ';alert(1)//
   • URL parameter: javascript:alert(1)
4. Check encoding: Determine if the application encodes <, >, ", ', and &. If not, the reflection is likely exploitable.
5. Verify execution: Use a proof-of-concept payload that calls alert(document.domain) to confirm execution in the browser context.

Common payloads

• <script>alert(document.domain)</script> — basic reflected
• <img src=x onerror=alert(1)> — event handler
• "><script>alert(1)</script> — attribute breakout
• javascript:alert(1) — URL scheme

False positive indicators

• Reflected input is HTML-encoded (< instead of <)
• Content-Type is not text/html (e.g., application/json)
• Input appears only in a CSP-protected context with script-src 'none'

Reporting

Include the exact HTTP request and response showing the reflection and the payload that executed.