# Cross-Site Scripting: Discovery

> Identify reflected, stored, and DOM-based XSS by finding where user input reaches an output context without proper encoding.

- **URL:** https://hackindex.io/learn/oswa-web-200-study-path/xss-introduction-and-discovery
- **Certification:** [OSWA (WEB-200) Study Path](https://hackindex.io/learn/oswa-web-200-study-path.md)
- **Estimated study hours:** 2
- **Published:** 2026-09-26
- **Updated:** 2026-09-27

Cross-site scripting (XSS) lets an attacker execute JavaScript in another user's browser in the context of the vulnerable application. It comes in three forms: reflected (payload echoed back in the immediate response), stored (payload persisted and served to other users), and DOM-based (payload processed entirely client-side by JavaScript). Discovery is about finding where user input reaches an output context without proper encoding, and confirming script execution in that context.

## Reflected and Stored XSS Discovery

Finding reflected XSS starts with confirming that input is echoed back, then identifying the exact output context: HTML body, attribute, JavaScript, or URL. The context dictates the payload. Stored XSS requires locating persistence points (comments, profiles, uploads) and testing whether stored input executes when rendered to a viewer. File uploads, SVG files, and filenames are common stored vectors, and blind XSS needs an out-of-band callback to confirm.

## DOM-Based XSS Discovery

DOM-based XSS never touches the server response body: JavaScript reads a source (location.hash, search params, postMessage, window.name) and writes it to a dangerous sink (innerHTML, document.write, eval). Discovery means tracing sources to sinks in the client-side code, setting breakpoints on sinks in DevTools, and using tooling like DOM Invader to automate the trace across single-page applications.

## Study material

- [Reflected XSS Checks](https://hackindex.io/services/web/vulnerability-discovery/reflected-xss-checks.md) (read, core)
- [Stored XSS Checks](https://hackindex.io/services/web/vulnerability-discovery/stored-xss-checks.md) (read, core)
- [DOM-Based XSS Checks](https://hackindex.io/services/web/vulnerability-discovery/dom-based-xss-checks.md) (read, core)