Generate Cross-Site Scripting (XSS) payloads tailored to injection context — HTML body, attributes, JavaScript strings, URLs, CSS, SVG, and JSON. Combine with encoding variants and WAF-bypass techniques, or pull known polyglots that execute across multiple contexts at once.
Target Configuration
Generated XSS Payloads
Click "Generate Payloads" to see the results
Complete Test URLs
Generate payloads first to see complete test URLs
cURL Test Commands
Generate payloads first to see cURL commands
About Cross-Site Scripting
XSS happens when user input reaches a browser-executed context without safe encoding. The right payload depends entirely on where the input lands — a payload that fires in HTML body won't work inside a JavaScript string, and vice versa. This tool breaks payloads down by context so you can target the exact sink you're probing.
Reflected XSS
Input in the request is reflected in the response unsanitized. Test by placing a marker in every parameter and grepping the HTML for it.
Stored XSS
Input is persisted and rendered to other users. Profile fields, comments, names, and uploaded filenames are classic sinks.
DOM XSS
Client-side JS reads attacker-controlled input (location, postMessage, storage) and writes it into a dangerous sink (innerHTML, eval, location).
Polyglots
Single payloads crafted to execute across multiple contexts. Useful for blind probing when you don't know how input will be reflected.
Testing Tips
- Inject a unique marker first (e.g.
xss_aa7b1) and inspect the rendered HTML to identify the exact reflection context. - If filters strip
<script>, try event handlers (onerror,onload,ontoggle,onfocus autofocus). - For JS-string context, close the quote and comment the rest of the line — or break out with
-/+to keep expressions valid. - Check the CSP header —
unsafe-inlinemissing means inline event handlers won't fire even if injected. - Test in multiple browsers; SVG and HTML parsing quirks differ between Chromium and Firefox.
- For DOM XSS, set breakpoints on
innerHTML,document.write, andevalto trace the sink.
Context Cheatsheet
- HTML body:
<svg onload=alert(1)> - Attribute (quoted):
"><svg onload=alert(1)> - JS string:
';alert(1);// - URL sink:
javascript:alert(1) - Template literal:
${alert(1)} - SVG:
<svg><script>alert(1)</script></svg>