XSS Payloads

Understanding the fundamental JavaScript payload structure used in Cross-Site Scripting attacks — the foundation before moving to advanced XSS techniques.

When WAFs and filters block raw XSS strings, Base64-encode your payload and use eval(atob()) or btoa(eval(atob())) to execute it — bypassing signature-based ...

When the injection point is inside innerHTML, script tags don't fire — but img onerror does. This one-liner exfiltrates localStorage without needing a script...

Attach a keydown event listener through an XSS payload to silently capture everything the victim types — passwords, search queries, form inputs — and stream ...

When inline script injection is blocked, host your payload externally and load it via a script src tag — bypassing length limits and WAF rules that filter in...

Replace the entire page with a cloned login form via XSS — the URL stays legitimate, the victim trusts it, and credentials go directly to your server.

Inject hidden username and password fields into the DOM — browsers auto-fill them with saved credentials. A delayed fetch sends those credentials to your ser...

Many apps store JWTs, API keys, and user data in localStorage and sessionStorage. This XSS payload silently exfiltrates all of it to your server.

Use an XSS injection to exfiltrate the victim's session cookie to your server — achieving full account takeover without knowing their password.

A production-grade XSS keylogger that handles network errors gracefully and logs each keystroke with confirmation — designed for stored XSS contexts where pe...