BERRY9 IT Services, home +91 86868 92922

Stored, Reflected, DOM-Based XSS: A Tester's Cheat Sheet

Cross-site scripting collapsed into the injection category in OWASP 2021, but operationally it is still its own discipline. Modern apps are JavaScript-heavy single-page applications where sinks are innerHTML, v-html, dangerouslySetInnerHTML and dozens of framework-specific equivalents. Here is a practical cheat sheet.

Request a scoping call Call +91 86868 92922

Web applications · By Thimmagurudu Bathini · Published · 6 min read · Last reviewed

Three flavors, three test strategies

Stored XSS — payload survives across sessions. Walk every input that another user will eventually render: profile fields, comments, file metadata, admin annotations. Polyglot payloads like jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )// survive most filters.

Reflected XSS — payload travels in the request. Walk every parameter that influences the response. Test all five contexts: HTML body, attribute, JS string, URL, CSS. Each has its own escape break-out.

DOM-based XSS — sink and source are both in JavaScript, server never sees the payload. This is where most modern XSS lives. You will not find it without grepping the JS bundle for sinks like innerHTML, document.write, eval, setTimeout(string), and tracing back to sources.

Common framework pitfalls

  • React — dangerouslySetInnerHTML, href={url} with javascript: URLs, third-party rich-text components
  • Vue — v-html, dynamic component names from props
  • Angular — bypassSecurityTrustHtml, innerHTML with manual sanitization
  • jQuery — $(userInput), .html() with concatenation

Defenses that actually work

Content-Security-Policy with strict-dynamic and nonces; framework defaults (do not opt out); HTML sanitizer libraries like DOMPurify for any user-controlled rich text. Reflected and stored XSS are well-mitigated by frameworks; DOM XSS is on you.

For a manual walk-through of every sink in your codebase, see web application VAPT or source code review.

Written by Thimmagurudu Bathini, BERRY9 IT SERVICES PRIVATE LIMITED, Hyderabad. Questions about your own systems? Request a scoping call or call +91 86868 92922.

Plan your next security test

Tell us what needs testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.

Request a scoping call WhatsApp