Cross-Site Scripting (XSS) Testing Skill

Purpose

Validate XSS vulnerabilities by injecting script payloads into user-controlled inputs and observing:

• Payload reflection without encoding in HTTP responses
• Script execution indicators in response content
• DOM manipulation via client-side JavaScript
• Stored payload retrieval from backend storage
• Context-specific injection (HTML body, attributes, JavaScript, CSS, URLs)

Vulnerability Types Covered

1. Reflected XSS / Non-Persistent XSS / Type 1 (CWE-79)

Payload is reflected directly from request to response without storage.

Detection Methods:

• Inject <script>alert(1)</script> in parameters, observe in response body
• Check if payload appears unencoded (<script> not converted to <script>)