Payloads.site / Payload Guides / XSS

Cross-Site Scripting (XSS) Payloads & Techniques

Cross-site scripting occurs when untrusted input is rendered in a page without proper output encoding, allowing an attacker to run arbitrary JavaScript in a victim's browser session. It's commonly used to steal session tokens, perform actions as another user, or deface application content.

Types of XSS

• Reflected — input is echoed immediately in the response, e.g. in search results or error messages.
• Stored — input is persisted server-side (e.g. a comment or profile field) and served to other users later.
• DOM-based — vulnerable client-side JavaScript writes untrusted data into the DOM, with no server round-trip involved.

Context Awareness

The right payload depends on where the input lands: raw HTML context usually needs a new tag, attribute context needs to break out of a quoted attribute first, and JavaScript context (inside an inline script or event handler) needs to close the surrounding string or expression before injecting code.

Representative Example Payloads

<script>alert(1)</script>
"><img src=x onerror=alert(1)>
'><svg onload=alert(1)>
javascript:alert(1)
"autofocus onfocus=alert(1) x="

These illustrate the mechanics of each context only. Effective testing also requires accounting for output encoding, CSP, and filter behavior — see the full, searchable payload library and encoder for a much larger, regularly updated set with built-in Base64/URL/HTML encoding.

Further reading: PortSwigger – Cross-site scripting (XSS)

Open the full XSS Payload Library & Encoder →