XSS Detection

Overview

Find, confirm, and fix Cross-Site Scripting vulnerabilities. XSS lets attackers inject scripts into web pages viewed by other users — stealing sessions, redirecting to phishing sites, or modifying page content.

Instructions

Reflected, stored and DOM-based XSS

Reflected: the payload comes from the current request (a URL or form field) and is echoed back in the response unsanitized — https://shop.northfield-outfitters.internal/search?q=<script>alert(1)</script>, sent to a victim as a link.

Stored: the payload is saved server-side (a comment, a profile field) and served to every visitor who later views that page, so it needs no link-click to trigger — more dangerous than reflected because it is persistent and scales to every viewer.

DOM-based: the payload never reaches the server. Client-side JavaScript reads untrusted data and writes it into the page: