xss

Identify all input entry points such as URL parameters, form fields, and HTTP headers, then inject context-appropriate payloads and observe whether JavaScript executes. Follow up with filter bypass techniques and confirm impact through observable side-effects like network beacons.

Burp Suite Active Scanner, OWASP ZAP, XSStrike, and Dalfox handle automated detection, while XSS Hunter, XSS.Report, and Hookbin capture blind XSS callbacks. Browser DevTools and Burp's DOM Invader extension help analyze DOM-based sinks.

Use encoding tricks like Unicode normalization and HTML entities, alternative syntax such as alert`1` template literals, nested tag mutations, and event handler alternatives like ontoggle or onbegin. The checklist includes specific bypasses for Cloudflare, Akamai, AWS WAF, Imperva, and F5.

Stored XSS persists in a database and executes for all visitors, reflected XSS bounces off the server in an immediate response via crafted URLs, and DOM XSS occurs entirely in client-side JavaScript without the payload reaching the server.

Modern browsers suppress alert dialogs in cross-origin iframes or background tabs, and CSP headers may block inline scripts. Prefer observable side-effects like console.log or fetch beacons, and check whether the payload context matches the reflection point.

Use the native Sanitizer API or DOMPurify for HTML insertion, enable Trusted Types via CSP, deploy strict CSP with nonces and strict-dynamic, and set HttpOnly, Secure, SameSite cookies. Fetch-Metadata headers and CORP/COEP/COOP policies add further isolation.