XSS Payload

Question 1

What is the basic payload structure for Reflected XSS?

Answer 1

<script>
alert(1)
</script>

Question 2

What payload works well in an HTML context?

Answer 2

<img src=x onerror=alert(1)>

Question 3

What payload works when injected into a JavaScript string?

Answer 3

’);alert(1);//

Question 4

What payload can be used inside a link or URL context?

Answer 4

javascript:alert(1)

Question 5

What payload is used in attribute injection (e.g., inside a tag)?

Answer 5

onmouseover=alert(1)

Question 6

Which JavaScript sinks should raise red flags for XSS?

Answer 6

innerHTML, document.write(), eval(), setTimeout(), location.href

Question 7

What tool can help generate and test XSS payloads?

Answer 7

Burp Suite (Intruder) or XSS cheat sheets

Question 8

What should you do instead of memorizing every payload?

Answer 8

Understand context, maintain a personal payload bank

Question 9

What GitHub resource provides common payloads for XSS?

Answer 9

PayloadAllTheThings

Question 10

What mindset helps with building payloads on the fly?

Answer 10

Learn how browsers parse input and recognize injection contexts