Hunt Xss

Autonomous Testing Priority

Verify reflection before claiming XSS, encoding is everything.

Your payload must appear in the response body with angle brackets UNESCAPED. <script> is XSS. <script> is safe encoding, not vulnerable.

Use a UNIQUE NUMERIC CANARY in your proof payload, e.g. <script>alert(91234)</script> or "><img src=x onerror=alert(91234)>. Pick a distinctive 4+ digit number, not alert(1). Practice pages are full of example payloads like alert(1)/alert('XSS') in their hint text; a unique number is how you tell YOUR reflected payload apart from the page's decoy examples. Proof = your alert(<canary>) shows up in the response with raw, unescaped angle brackets.

Try these contexts in order:

1. Inline script injection (works when HTML context allows new tags):

   <script>alert(CANARY)</script>
   

   Use whatever canary string your proof contract specifies. Confirmed when <script>alert(CANARY) appears literally (not HTML-encoded) in the response.

2. Attribute event injection (when < is filtered but attributes are injectable):

   " onmouseover="alert(CANARY)
   " onerror="alert(CANARY)
   " onload="alert(CANARY)
   

3. URL/href context:

   javascript:alert(CANARY)
   

Distinguishing success from failure:

• Vulnerable: response contains <script>alert( unescaped, browser would execute it
• Filtered/safe: response contains <script> or <script>, properly encoded
• Blocked: response is an error, or the reflected value is absent entirely

For stored XSS: inject into a field that other pages display (comments, usernames, ticket titles). Then fetch the rendering page and check for unescaped payload. The payload executes when any user views that page, higher severity than reflected.

---

Crown Jewel Targets