XSS Cheat Sheet (Cross Site Scripting Cheat Sheet)

Cross-Site Scripting (XSS) is one of the most prevalent and dangerous vulnerabilities in web applications. It allows attackers to inject malicious scripts into trusted websites, which then execute in the victim’s browser. This XSS cheat sheet provides a comprehensive guide covering concepts, payloads, prevention strategies, and tools to understand and defend against XSS attacks effectively.

What is Cross-Site Scripting (XSS)?

XSS is a vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. These scripts can steal cookies, perform actions on behalf of users, or redirect them to malicious sites. XSS attacks typically exploit improper validation or escaping of user inputs.

Why is XSS Dangerous?

XSS can lead to severe consequences, including:

• Stealing Sensitive Information: Cookies, tokens, and session data.
• Identity Theft: Hijacking user sessions.
• Phishing: Redirecting users to malicious websites.
• Defacement: Modifying content on the web page.

Types of XSS Attacks

Reflected XSS

• Description: The injected script is reflected in the server's response and executed in the victim's browser.
• Example Scenario: A search query that returns user input directly without sanitization.

Stored XSS

• Description: Malicious scripts are stored on the server (e.g., in a database) and executed when the content is retrieved.
• Example Scenario: User-generated content fields like comments or chat messages.

DOM-Based XSS

• Description: Vulnerabilities exist in the client-side code where user input directly manipulates the DOM.
• Example Scenario: JavaScript dynamically modifying the page content using untrusted data.

XSS Payloads Cheat Sheet

Basic Payloads

Advanced Payloads

Steal Cookies:

Redirect Victim:

Event-Based Payloads

On Error:

On Mouse Over:

Obfuscated Payloads

Using Hex Encoding:

Breaking Strings:

XSS Attack Workflow

1. Identify Input Points:
   Locate input fields or URL parameters that accept user data.
2. Test for Vulnerability:
   Inject harmless payloads like <script>alert(1)</script> to check execution.
3. Craft Malicious Payloads:
   Use payloads to steal cookies, redirect users, or execute JavaScript.
4. Deliver Payload:
   Embed payloads in links, forms, or stored inputs.
5. Execute Attack:
   Payloads execute when victims interact with the vulnerable application.

Reflected XSS Cheat Sheet

How it Works:
User input is reflected immediately in the HTTP response.

Example Vulnerability:

Mitigation:

• Encode output data.
• Use parameterized queries.

Stored XSS Cheat Sheet

How it Works:
Malicious scripts are stored persistently on the server.

Example:

• Malicious payloads like <script>alert('XSS')</script> are stored in the database.
• Mitigation:
  • Sanitize input on server side.
  • Validate and encode output.

DOM XSS Cheat Sheet

How it Works:
Vulnerabilities exist in JavaScript, manipulating the DOM without sanitization.

Example Code:

Mitigation:

• Use textContent or innerText instead of innerHTML.
• Avoid using eval() and similar unsafe APIs.

OWASP XSS Prevention Cheat Sheet

The OWASP XSS Prevention Cheat Sheet provides effective steps to mitigate XSS vulnerabilities.

Key Recommendations:

1. Input Validation: Allow only valid and expected inputs using whitelists.
2. Output Encoding: Encode data based on its context (HTML, JavaScript, or URL).
3. Content Security Policy (CSP): Restrict the execution of scripts to trusted sources.
4. Sanitization: Use libraries like DOMPurify to sanitize HTML content.

XSS Prevention Techniques

1. Escape Output: Escape characters like <, >, &, and ' when displaying data.
2. Avoid Dangerous APIs: Avoid eval(), document.write(), and innerHTML.
3. Validate Input: Ensure inputs conform to expected patterns.
4. Enable Security Headers:
   • Content Security Policy (CSP)
   • X-XSS-Protection

XSS Script Cheat Sheet

Commonly Used Scripts:

Simple Alert:

Redirect:

Keylogger:

WAF Bypass XSS Cheat Sheet

Encoding Tricks:
Use hexadecimal or Unicode encoding to bypass filters.

String Concatenation:

Break payloads into parts to evade detection.

Polyglot Payloads:
Use payloads compatible in multiple contexts (HTML, JavaScript).

Event Handlers:

Tools for Detecting XSS

1. Burp Suite: Automated vulnerability scanning.
2. OWASP ZAP: Open-source penetration testing tool.
3. XSS Me: Firefox plugin for XSS testing.
4. DOMPurify: Library for sanitizing HTML inputs.

Best Practices to Protect Against XSS

1. Use a Framework: Frameworks like React and Angular escape output by default.
2. Adopt Secure Coding Standards: Train developers on secure coding practices.
3. Monitor Web Traffic: Use intrusion detection systems to spot unusual activity.
4. Perform Regular Audits: Test applications for vulnerabilities regularly.

Conclusion

This XSS Cheat Sheet provides a comprehensive guide to understanding, detecting, and mitigating XSS vulnerabilities. By using secure coding practices, applying the OWASP XSS prevention cheat sheet, and adopting advanced tools, developers can protect their applications from one of the most dangerous web application vulnerabilities. Stay vigilant, and ensure security is a priority in every stage of your development process.

More Cheat Sheets and Top Picks

• React Cheat Sheet
• Markdown Cheat Sheet
• Nmap Cheat Sheet
• Tmux Cheat Sheet
• XPath Cheat Sheet
• Java Cheat Sheet