Understanding the Landscape of XSS Vulnerabilities

Cross-Site Scripting (XSS) remains a persistent and pervasive threat in web application security. While its fundamental mechanics haven't changed drastically, the attack vectors, evasion techniques, and impact have evolved significantly, driven by complex application architectures, single-page applications (SPAs), and increasingly sophisticated client-side JavaScript. For practitioners, a deep understanding of XSS beyond basic alert(1) payloads is crucial for effective detection, exploitation, and prevention. This guide aims to provide a practitioner-focused deep dive into the nuances of XSS, focusing on core mechanics, notable techniques, and real-world implications.

Core Mechanics of XSS

At its heart, XSS is a client-side vulnerability where an attacker injects malicious scripts into web pages viewed by other users. The script then executes within the victim's browser, inheriting the privileges of the application it's injected into. This allows attackers to impersonate users, steal sensitive data, hijack sessions, and perform unauthorized actions. The primary categories of XSS are:

• Stored XSS (Persistent XSS): Malicious scripts are permanently stored on the target server, often in a database, and executed whenever a user views the compromised page. This is generally considered the most severe type due to its widespread impact. Examples include injecting scripts into user profiles, comments, or forum posts. ^[1]
• Reflected XSS: The malicious script is embedded within a URL or other request parameter and is reflected back in the server's response, executing in the victim's browser when they click a crafted link. This type is non-persistent and requires user interaction. ^[1]
• DOM-based XSS: This occurs when client-side JavaScript code processes untrusted data in an unsafe manner, leading to malicious script execution within the browser's Document Object Model (DOM). The vulnerability lies in the JavaScript code itself, not necessarily in how the server handles input. ^[2][3]

A less critical variant, Self-XSS, typically only affects the user executing the script in their own browser and is usually not considered a critical vulnerability unless it can be chained with other attacks like UI redressing. ^[4]

Notable XSS Techniques and Exploitation Vectors

The landscape of XSS exploitation is vast and ever-changing. Attackers constantly devise new methods to bypass security controls and leverage modern web technologies.

Advanced Injection Contexts and Payload Delivery

Beyond basic HTML injection, attackers target specific contexts:

• Attribute Injection: Malicious scripts can be injected into HTML attributes by bypassing frontend validation. ^[5]
• JavaScript Context Injection: Injecting script into dynamically generated JavaScript code, often through improperly escaped JSON or script blocks. ^[6][7]
• CSS Injection: Exploiting CSS properties that can execute JavaScript, such as within url() directives or via SVG embedded in CSS. ^[8]
• URL Parameter XSS: Injecting payloads into URL parameters, which are then reflected in the page or processed by client-side scripts. ^[9]
• SVG XSS: Malicious SVG files can contain embedded scripts or CSS that execute when rendered, often leading to account takeover by stealing authentication tokens. ^[8][10]
• Filename XSS: Injecting malicious scripts into filenames, which are then rendered unsanitized in administrative views, impacting privileged users. ^[11]
• Template Injection: Affects templating engines where user input is directly embedded into template structures, potentially allowing arbitrary code execution. ^[12]
• Log Injection: Manipulating input data to inject malicious code into application logs, which can then be rendered as HTML in a log viewer, leading to XSS. ^[13]

DOM-Based XSS and Browser Quirks

DOM-based XSS is particularly insidious because it often bypasses server-side security controls. Attackers exploit how JavaScript manipulates the DOM:

• DOM Clobbering: This technique involves manipulating the DOM to override native JavaScript objects or properties, often through crafted id or name attributes, to bypass sanitization or control script execution. It has been seen in frameworks like React and Vue. ^[14][15]
• Mutation XSS (mXSS): Exploits how browsers parse and "fix" malformed HTML, or how sanitization libraries handle specific input patterns, leading to script execution. For instance, a bug in DOMPurify's regular expressions has been leveraged for mXSS. ^[16][17]
• Browser Quirk Exploitation: Leveraging differences in how various browsers parse and render HTML and JavaScript to bypass security measures. For example, a reflected XSS flaw bypasses Amazon CloudFront WAF on Safari due to its unique handling of reflected content. ^[18]
• srcdoc Attribute Exploitation: The srcdoc attribute on `