and

, then observe whether the application encodes output or executes the script in the browser."}},{"@type":"Question","name":"What is the difference between stored, reflected, and DOM-based XSS?","acceptedAnswer":{"@type":"Answer","text":"Stored XSS persists in a database and affects all viewers of the page. Reflected XSS appears only in the immediate response to a crafted request, requiring victim interaction with a malicious URL. DOM-based XSS executes entirely client-side when JavaScript processes user-controlled data through dangerous sinks like innerHTML."}},{"@type":"Question","name":"How can XSS filters and WAFs be bypassed during testing?","acceptedAnswer":{"@type":"Answer","text":"Common bypass techniques include case variation in tags, HTML entity and hex encoding, malformed tag syntax, JavaScript obfuscation with template literals or eval, and whitespace insertion. The Skill documents specific payload variations for each filter evasion approach."}},{"@type":"Question","name":"Why is my XSS payload not executing in the browser?","acceptedAnswer":{"@type":"Answer","text":"Common causes include Content Security Policy blocking inline scripts, output encoding neutralizing the payload, or the payload being trapped inside an attribute or comment context. Check the browser console for CSP violations and try event-handler-based payloads like svg onload instead of script tags."}},{"@type":"Question","name":"Can XSS steal cookies protected by the HttpOnly flag?","acceptedAnswer":{"@type":"Answer","text":"No, HttpOnly cookies cannot be accessed via document.cookie in JavaScript. In such cases, testers can target localStorage or sessionStorage data, or demonstrate impact through phishing form injection and keylogging payloads instead of direct cookie theft."}},{"@type":"Question","name":"What authorization is required before XSS testing?","acceptedAnswer":{"@type":"Answer","text":"Written authorization for security testing is mandatory, along with a defined scope covering target domains and features. Agreements on handling captured session data and established incident response procedures are also required before testing begins."}}]}]}

zebbernCOMMUNITY

Explore all skills by this author →

Verified:Website GitHub

xss-html-injection

Detects and exploits XSS and HTML injection vulnerabilities in web applications during authorized security testing.

4.6k|462|Updated Jun 21, 2025

Search Tags:#vulnerability assessment #XSS #penetration testing #web security #cross-site scripting #HTML injection #CSP bypass

One-click install

npx skills add https://github.com/zebbern/claude-code-guide --skill xss-html-injection

Or copy as Structured Prompt for Agent▼

Please help me install this Agent Skill.
Skill: xss-html-injection
Source: https://github.com/zebbern/claude-code-guide/tree/main/skills/xss-html-injection
Command: npx skills add https://github.com/zebbern/claude-code-guide --skill xss-html-injection

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Web applications often fail to sanitize user input, leaving them exposed to cross-site scripting and HTML injection attacks. This Skill provides a systematic methodology for security testers to detect, classify, and demonstrate these client-side injection flaws before malicious actors exploit them.

Core Features & Use Cases

Multi-Vector Detection: Identify stored, reflected, and DOM-based XSS through input reflection analysis, dangerous sink/source mapping, and context-aware payload testing.
Exploitation Demonstrations: Craft proof-of-concept payloads for cookie theft, session hijacking, keylogging, and phishing form injection to demonstrate real-world impact.
Filter and CSP Bypass Techniques: Apply encoding variations, tag obfuscation, and JSONP-based bypasses to test the effectiveness of WAFs and Content Security Policies.
Use Case: During an authorized penetration test of an e-commerce site, use this Skill to discover a stored XSS flaw in the product review section, demonstrate session cookie exfiltration in a controlled environment, and deliver remediation guidance including CSP configuration.

Quick Start

Test the search functionality of my authorized target web application for reflected and stored XSS vulnerabilities and report any findings with proof-of-concept payloads.

Frequently Asked Questions about xss-html-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test a web application for XSS vulnerabilities?▼

Start by identifying input reflection points such as search boxes, profile fields, and URL parameters. Insert test payloads like <script>alert(1)</script> and <img src=x onerror=alert(1)>, then observe whether the application encodes output or executes the script in the browser.

What is the difference between stored, reflected, and DOM-based XSS?▼

Stored XSS persists in a database and affects all viewers of the page. Reflected XSS appears only in the immediate response to a crafted request, requiring victim interaction with a malicious URL. DOM-based XSS executes entirely client-side when JavaScript processes user-controlled data through dangerous sinks like innerHTML.

How can XSS filters and WAFs be bypassed during testing?▼

Common bypass techniques include case variation in tags, HTML entity and hex encoding, malformed tag syntax, JavaScript obfuscation with template literals or eval, and whitespace insertion. The Skill documents specific payload variations for each filter evasion approach.

Why is my XSS payload not executing in the browser?▼

Common causes include Content Security Policy blocking inline scripts, output encoding neutralizing the payload, or the payload being trapped inside an attribute or comment context. Check the browser console for CSP violations and try event-handler-based payloads like svg onload instead of script tags.

Can XSS steal cookies protected by the HttpOnly flag?▼

No, HttpOnly cookies cannot be accessed via document.cookie in JavaScript. In such cases, testers can target localStorage or sessionStorage data, or demonstrate impact through phishing form injection and keylogging payloads instead of direct cookie theft.

What authorization is required before XSS testing?▼

Written authorization for security testing is mandatory, along with a defined scope covering target domains and features. Agreements on handling captured session data and established incident response procedures are also required before testing begins.