--- name: xss-testing description: Validate Cross-Site Scripting (XSS) vulnerabilities including Reflected, Stored, and DOM-based XSS. Test by injecting script payloads into user-controlled inputs and observing if they execute in browser context. Use when testing CWE-79 (XSS), CWE-80 (Basic XSS), CWE-81 (Error Message XSS), CWE-83 (Attribute XSS), CWE-84 (URI Scheme XSS), CWE-85 (Doubled Character XSS), CWE-86 (Invalid Character XSS), CWE-87 (Alternate XSS Syntax), or related XSS findings. allowed-tools: Read, Write, Bash --- # Cross-Site Scripting (XSS) Testing Skill ## Purpose Validate XSS vulnerabilities by injecting script payloads into user-controlled inputs and observing: - **Payload reflection** without encoding in HTTP responses - **Script execution** indicators in response content - **DOM manipulation** via client-side JavaScript - **Stored payload retrieval** from backend storage - **Context-specific injection** (HTML body, attributes, JavaScript, CSS, URLs) ## Vulnerability Types Covered ### 1. Reflected XSS / Non-Persistent XSS / Type 1 (CWE-79) Payload is reflected directly from request to response without storage. **Detection Methods:** - Inject `` in parameters, observe in response body - Check if payload appears unencoded (` Response:

Results for:

``` ### 2. Stored XSS / Persistent XSS / Type 2 (CWE-79) Payload is stored server-side and served to other users. **Detection Methods:** - Submit payload via form/API, retrieve via separate request - Check if payload persists and reflects to other users/sessions **Example Attack:** ``` POST /comments {"body": ""} GET /comments → Response includes stored script ``` ### 3. DOM-Based XSS / Type 0 (CWE-79) Payload is injected via client-side JavaScript manipulating the DOM. **Detection Methods:** - Inject payload in URL fragment (`#` reflected unencoded. ### 5. Error Message XSS (CWE-81) XSS in application error pages/messages. **Detection:** Inject payload that triggers error, check error page for reflection. ### 6. Attribute Context XSS (CWE-83) Payload breaks out of HTML attribute context. **Detection Methods:** - `" onmouseover="alert(1)` — break double-quoted attribute - `' onfocus='alert(1)` — break single-quoted attribute - `" autofocus onfocus="alert(1)` — auto-triggering **Example:** ```html Payload: " onfocus="alert(1)" autofocus=" Result: ``` ### 7. URI Scheme XSS (CWE-84) Injection via `javascript:` or `data:` URI schemes. **Detection:** `javascript:alert(1)` in href/src attributes. **Example:** ```html Click Payload: javascript:alert(1) Result: Click ``` ### 8. Doubled Character XSS (CWE-85) Bypass filters using doubled/nested characters. **Detection:** `</script>` bypasses naive stripping. ### 9. Invalid Character XSS (CWE-86) Injection using invalid/special Unicode characters. **Detection:** Null bytes, UTF-7, charset confusion attacks. ### 10. Alternate XSS Syntax (CWE-87) Non-standard XSS vectors that bypass filters. **Detection Methods:** - `` - `` - `` - `