There is a great list of XSS vectors avaliable here: http://ha.ckers.org/xss.html, but It hasn't changed much lately (eg. latest FF version mentioned is 2.0).

Is there any other list as good as this, but up to date?

  • 4
    We need less cheatsheets/tools and more in-depth methodology manuals for findings issues such as XSS. It should also be noted that manual code review and control-based gap analysis are easier methods to find and eradicate XSS issues, especially over extremely large codebases and across a large number of applications.
    – atdre
    Commented Nov 14, 2010 at 12:55
  • 1
    @atdre, I agree - in principle. However, a missing control is often not enough for a business to decide to commit the resources to fix the lack. Indeed, risk management would require you to show if the flaw is exploitable, or just best-practice/defense-in-depth.
    – AviD
    Commented Nov 14, 2010 at 23:53
  • 1
    @AviD: Hahahahaha, XSS is always exploitable. I completely disagree with you. Demonstrating risk management issues through risk assessments is a total waste of time for application security! Does an organization need to practice the fine art of stealing their own trucks at gunpoint in order to prove the risk management issues with drivers going through bad neighborhoods, at night, with PR all over their location and truck contents?
    – atdre
    Commented Nov 15, 2010 at 1:27
  • 1
    Looks like I missed out a lot through the weekend :) A word from me - I consider such cheat-sheets useful for learning what should I look out for when coding. And I don't have to be a blackhat to want to try and exploit an app without code review. (eg. an app written in my company, but in a language I'm not familiar with)
    – naugtur
    Commented Nov 15, 2010 at 9:55
  • 1
    Actually, @naugtur, I think the comments here are extremely helpful, possibly even more than the answers themselves - but then again, I might be biased. I think the back'n'forth I had with @atdre was topical, and of high value - but probably deserved its own question/discussion. But again, I'm probably biased :)
    – AviD
    Commented Dec 6, 2010 at 13:17

5 Answers 5


The best new one I've seen recently is here http://html5sec.org/ good list of vectors with browser support noted and has quite a few of the more obscure ones.

  • 2
    Mario Heiderich is also releasing a book next month that should explore this and related topics more in-depth. Here is a link to the book: isbn.nu/1597496049
    – atdre
    Commented Nov 14, 2010 at 12:53
  • I read the book. While some of its parts are already outdated, it's definitely a must-read if someone is into XSS, though it also covers other areas. Commented Sep 19, 2011 at 13:19

If you really want to understand XSS, I strongly recommend OWASP's XSS Prevention Cheat Sheet. It's not focused on hacking, it's focused on helping developers prevent these problems in the first place. http://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet


Yes, grab fuzzdb from http://code.google.com/p/fuzzdb/:

fuzzdb helps identify security flaws in applications by aggregating known attack patterns, predictable resource names, and server response messages to create a comprehensive, repeatable set of malformed input test cases.

fuzzdb has a great list of attack payloads.


RSnake's XSS cheatsheat (that you linked to) is still pretty much the definitive reesource, and it is even referenced in OWASP's secure coding guide (which is in turn referenced by PCI:DSS).
True, since RSnake is taking a step back from that stuff, going forward this might change, but as of now thats the place to go.

UPDATE: RSnake has officially retired from blogging, and declared that he won't be making any updates. So while this may have been up-to-date up until last month, apparently it's not anymore.

  • 2
    I think fuzzdb may supersede rsnake's xss cheatsheet given it is one of the primary sources for fuzzdb in addition to many other sources Commented Nov 14, 2010 at 23:50

There has been a newly available xss cheat sheet, it contains massive amount of vectors that work on all modern browsers.

LINK: http://packetstormsecurity.com/files/download/124419/WAF_Bypassing_By_RAFAYBALOCH.pdf

Not the answer you're looking for? Browse other questions tagged .