xss-cross-site-scripting

An expert-level Cross-Site Scripting attack playbook intended for authorized security testing. It is meant to be loaded when user-controlled content reaches HTML bodies, attribute values, JavaScript strings, DOM sinks, file uploads, or multi-context rendering paths, and it deliberately skips beginner material to concentrate on the techniques base models typically miss. Identifying the injection context before choosing a payload is the central discipline it enforces.

At its core is an injection context matrix that maps each rendering context to the right opener and payload, backed by a quick-pick reference table covering the HTML body, quoted attributes, JavaScript strings, URL and href sinks, block tags such as title and textarea, and SVG or XML sinks. Beyond single-context reflection it addresses multi-reflection attacks, where one payload must fire from several reflection points, plus advanced vectors: DOM insertion via innerHTML or document.write, PHP_SELF path injection, file upload XSS through filenames, SVG uploads and EXIF metadata, postMessage handlers without origin checks, and XML-based injection.

Defensive-control evasion is covered in depth. CSP bypass techniques include JSONP endpoints on allow-listed domains, AngularJS CDN abuse, Angular expression (client-side template injection) escapes, base-uri injection, and dangling-markup exfiltration when script is blocked but images are allowed. Filter and WAF bypass covers parameter-name attacks, encoding chains such as double-encoding and CRLF, and tag mutation. Two companion files extend the material: SCENARIOS.md for real CVE cases, HttpOnly bypass, XS-Leaks side channels, and session fixation, and ADVANCED_XSS_TRICKS.md for mXSS and DOMPurify bypass, DOM clobbering, modern framework XSS, Trusted Types bypass, and Service Worker persistence. A related upload-insecure-files skill is referenced for the full upload validation, storage, and preview path.