domains / families / security / xss-cross-site-scripting

xss-cross-site-scripting

separate

XSS playbook. Use when user-controlled content reaches HTML, attributes, JavaScript, DOM sinks, uploads, or multi-context rendering paths.

When to use

• XSS playbook
• user-controlled content reaching HTML, attributes, JavaScript, DOM sinks, uploads, or multi-context rendering paths
• non-obvious XSS techniques
• context-specific payload selection
• WAF bypass
• CSP bypass
• post-exploitation
• multi-reflection attacks

When not to use

• basic XSS payloads like <script>alert(1)</script>

Skill page

Source