Loading…
A categorized reference of cross-site scripting payloads for authorized testing, filter evaluation, and detection.
Cross-site scripting (XSS) is the injection of attacker-controlled script into a page that other users' browsers then execute, in the victim's session and origin. This reference groups the classic, well-documented payloads by the context they target, because the single most important fact about XSS is that the right payload — and the right defense — depends entirely on where the input lands.
Context is everything. In an HTML body, <script>alert(1)</script> or <img src=x onerror=alert(1)> works. Inside an HTML attribute, you must first break out of the quotes (" onmouseover="alert(1)). Inside an existing JavaScript string, you break out of the string or the script block instead. Filter-bypass variants use event handlers without <script>, template literals to avoid parentheses, the javascript: URI scheme, or entity-encoded nesting to evade naive blocklists.
How you'll use it. Pick a context to see representative payloads with a note on each. Use them to confirm a reflected or stored XSS on a target you are authorized to test, to evaluate whether an input filter or WAF actually holds, and to build detections. The categorization doubles as a teaching aid for why a filter that strips <script> still fails against an onerror handler.
Types of XSS. Reflected XSS bounces off a request parameter; stored XSS persists in the database and hits every viewer; DOM-based XSS never touches the server, arising when client-side JavaScript writes untrusted data into a sink like innerHTML. Each needs the same contextual thinking. Stored XSS is the most damaging of the three because a single injected payload executes in the session of everyone who loads the affected page — including administrators — which is how an XSS bug escalates into full account or application takeover.
Why a blocklist fails. The recurring lesson of this reference is that stripping the string <script> is not a defense. The same effect is reachable through <img onerror>, <svg onload>, <body onpageshow>, the javascript: URI scheme, and dozens more vectors, many of which need no angle brackets at all once you are inside an attribute or a script context. Any filter that enumerates bad patterns is playing a game it cannot win; encoding the output for its context is the move that closes every variant at once.
Defensive angle — the real fixes. Contextual output encoding is primary: HTML-encode for body/attributes, JavaScript-encode for script contexts, URL-encode for URLs. Prefer frameworks that auto-escape (React, modern templates) and treat innerHTML/dangerouslySetInnerHTML as reviewed exceptions. Layer a strict Content-Security-Policy (nonce/hash-based, no unsafe-inline) so a missed escape does not become code execution — grade yours with the security header analyzer — set HttpOnly on session cookies to blunt token theft, and sanitize rich HTML with a vetted library like DOMPurify rather than a homemade blocklist.
Generate reverse-shell one-liners (bash, nc, python, php, perl, powershell, and more) for a given listener host and port.
A categorized reference of canonical SQL injection payloads for authorized testing and WAF/detection engineering.