Web Hacking for Pentesters: Cross-Site Scripting (XSS)

XSS is still everywhere because escaping is boring and templates are big. For testers, the job is finding where user input becomes executable in the wrong context—not collecting alert boxes.

Impact ranges from nuisance to account compromise depending on cookie flags, CSP, and what sensitive actions live in-session.

XSS impact narratives should mention who can reach the sink and what their session can do—context drives severity more than payload creativity.

Contexts that matter

HTML, attribute, JavaScript, URL, and DOM sinks each need different thinking. Stored beats reflected for persistence; blind XSS via contact forms still pays on some programs.

CSP and sanitizers reduce but rarely eliminate logic bugs.

Authorized approach

Identify sinks in responses and client-side routers. Use benign markers in staging. Show session or action impact with test users only.

• Check postMessage and JSONP adjacent issues

• Note HttpOnly on session cookies

• Recommend context-aware encoding in remediation

Reporting

One minimal reproduction, clear scope URL, and realistic abuse scenario beats a payload list.

Don't spray public XSS payloads on production users.

Follow program rules on automated XSS scanners.

For stored XSS, note who can view the payload—admin-only storage differs from public profile fields in severity.

Small habits compound—what feels like overhead early becomes speed when deadlines hit.

Defense depth notes

CSP bypasses belong in reports only when demonstrated on in-scope pages—mention bypass enablers like script gadgets conceptually if needed.

Test admin-only XSS separately—impact jumps when privileged sessions are in play.

Sink prioritization

Prioritize sinks reachable by low-privilege users before hunting admin-only reflection.

DOM XSS needs browser testing—don't close tickets from static analysis alone.

Recommend CSP reporting endpoints to catch production breakage early.

---

Worth reading next

CORS, postMessage, and Origin Mistakes in Modern Web Apps

Web Hacking for Pentesters: Cross-Site Request Forgery (CSRF)

Information Disclosure: The Quiet Vulnerability Class