So I have a reflected XSS vulnerability where I get a pop up by entering <script>alert(2)</script> in the search field. I can't see this payload ('2') anywhere on the screen, neither if I view source.

What would be the correct approach to debug this XSS and find out where is the location it's being executed? Normally I would just open Developer Tools and use 'Pick an element on the web page' and click on payload and it would show, but in this case I don't know where it's located.

I imagine I could use breakpoints.

  • To clarify, are you looking for what code places the XSS, or where the script winds up on the webpage that it's ran? Searching in the element view can help you find where it is, as well as adding some text outside of the script tag as a visual aid. – Kevin Mirsky May 1 at 14:53
  • See also Techniques to pinpoint XSS injection point – Sjoerd May 1 at 15:23

This could be a DOM XSS, meaning that the script tag is injected using JavaScript instead of the server. Try opening up the developer console (F12) and injecting one of these values:

  • <script>debugger</script>, opens the debugger. Check the call stack on the right to see what is going on.
  • <script>throw "XSS"</script>, and check the console for where the error occurred.

The injected script would still be visible in the DOM that is displayed in the developer console (or with "Inspect element"), even if it is not in the HTML source.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.