OSWA · Module 4

Cross-Site Scripting: Discovery

Identify reflected, stored, and DOM-based XSS by finding where user input reaches an output context without proper encoding.

~2 h 3 resources Last updated September 27, 2026

Cross-site scripting (XSS) lets an attacker execute JavaScript in another user's browser in the context of the vulnerable application. It comes in three forms: reflected (payload echoed back in the immediate response), stored (payload persisted and served to other users), and DOM-based (payload processed entirely client-side by JavaScript). Discovery is about finding where user input reaches an output context without proper encoding, and confirming script execution in that context.

Reflected and Stored XSS Discovery

Finding reflected XSS starts with confirming that input is echoed back, then identifying the exact output context: HTML body, attribute, JavaScript, or URL. The context dictates the payload. Stored XSS requires locating persistence points (comments, profiles, uploads) and testing whether stored input executes when rendered to a viewer. File uploads, SVG files, and filenames are common stored vectors, and blind XSS needs an out-of-band callback to confirm.

DOM-Based XSS Discovery

DOM-based XSS never touches the server response body: JavaScript reads a source (location.hash, search params, postMessage, window.name) and writes it to a dangerous sink (innerHTML, document.write, eval). Discovery means tracing sources to sinks in the client-side code, setting breakpoints on sinks in DevTools, and using tooling like DOM Invader to automate the trace across single-page applications.

Read

The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.

Mark Reflected XSS Checks as done

Guide 5 min read
Reflected XSS Checks
Focus on #Confirm Reflection First #Check the Injection Context #Test a Basic Payload #Check for CSP #Automated Scanning with dalfox #POST Parameter Testing
Mark Stored XSS Checks as done

Guide 5 min read
Stored XSS Checks
Focus on #Identify Storage Points #Inject a Unique Marker #Test HTML Injection and Script Execution #Input Sanitization vs Output Encoding #File Upload as XSS Vector #Blind XSS #Automated Scanning with dalfox
Mark DOM-Based XSS Checks as done

Guide 6 min read
DOM-Based XSS Checks
Focus on #Identifying Sources #Identifying Sinks #Browser DevTools Approach #DOM Breakpoints #DOM Invader (Burp Suite) #Testing SPAs #Hash-Based Routing #History API Routing #Manual Testing Payloads #Hash Fragment Payloads #Search Parameter Payloads #postMessage Payloads #window.name Injection #Grep for Sinks in JavaScript Files