SKILL: Cross-Site Scripting (XSS) — Expert Attack Playbook
> AI LOAD INSTRUCTION: This skill covers non-obvious XSS techniques, context-specific payload selection, WAF bypass, CSP bypass, and post-exploitation. Assume the reader already knows <script>alert(1)</script> — this file only covers what base models typically miss. For real-world CVE cases, HttpOnly bypass strategies, XS-Leaks side channels, and session fixation attacks, load the companion SCENARIOS.md.
0. RELATED ROUTING
Extended Scenarios
Also load SCENARIOS.md when you need:
- Django debug page XSS (CVE-2017-12794) — duplicate key error → unescaped exception → XSS
- UTF-7 XSS for legacy IE environments (+ADw-script+AD4-)
- HttpOnly bypass methodology — proxy-the-browser, session riding, CSRF-via-XSS
- XS-Leaks side channel attacks — timing oracle, cache probing, performance.now() measurement
- Session fixation via XSS — pre-set session ID before victim login
- DOM clobbering techniques for CSP-restricted environments
Advanced Tricks
Also load ADVANCED_XSS_TRICKS.md when you need:
- mXSS / DOMPurify bypass — namespace confusion, <noscript> parsing differential, form/table restructuring
- DOM Clobbering — property override via id/name, HTMLCollection, deep property chains
- Modern framework XSS — React dangerouslySetInnerHTML, Vue v-html, Angular bypassSecurityTrust*, Next.js SSR
- Trusted Types bypass — default policy abuse, non-TT sinks, policy passthrough
- Service Worker XSS persistence — malicious SW registration, fetch interception, post-patch survival
- PDF/SVG/MathML XSS vectors, polyglot payloads, browser-specific tricks
- XS-Leaks & side channels — timing oracle, frame counting, cache probing, error event oracle
Before broad payload spraying, you can first load:
- upload insecure files when you need the full upload path: validation, storage, preview,
（为兼容发布已截断）
