Cross-Site Scripting (XSS)

Target Recon Testing Checklist

• 1.Identify user input parameters rendered back in page HTML.
• 2.Check form fields, query strings, headers, and referrer states.
• 3.Test script injections inside HTML context: <script>alert(1)</script>
• 4.Test script injections inside attribute context: " onmouseover="alert(1)
• 5.Test script injections inside script context or JSON outputs.
• 6.Audit Content-Security-Policy (CSP) headers for unsafe-inline rules.

Testing Parameters & Payloads

<script>alert(document.cookie)</script>

<img src=x onerror=alert(1)>

javascript:alert(1)

"><script>alert(1)</script>

${alert(1)}

Mitigation & Safe Development Guidelines

• Apply context-aware output encoding on all user variables before rendering.
• Use safe templating frameworks (React/Angular) which encode automatically.
• Implement strict Content-Security-Policy (CSP) headers.
• Configure SameSite cookie attributes to restrict session hijackings.