XSS
Marker first. Context second. Execute third. Cookie/CSP last.
Tags: xss, csp, ato
Checklist
- Marker: vulnsXSS or a unique string. Find every reflection, including JSON, attributes, JS, headers, files.
- Context: HTML body, attribute, quoted JS, unquoted JS, URL, CSS, SVG, Markdown, template.
- DOM: Source to sink in JS. Hash, postMessage, storage, reserved names, clobbering.
- Stored: Profile, comments, filenames, webhooks, email-to-ticket, admin-only render (still XSS if an admin views it).
- CSP: Does it actually block your payload? Nonce, JSONP allowlist, Angular, unsafe-inline.
- Cookie: HttpOnly? Domain=.parent? Can you call an authenticated API from the XSS (CSRF-style) even if you cannot read the cookie?
- Impact: Session, token in localStorage, OAuth implicit, admin panel, or just a self-XSS? Be honest.