Xss Cross Site Scripting

This is a practical XSS reference that skips the basics and goes straight to the techniques that catch people off guard. You get context-specific payloads for when reflection lands in HTML attributes, JavaScript strings, or DOM sinks, plus WAF bypass strategies like parameter name injection and encoding chains. The multi-reflection attacks and CSP bypass section using JSONP endpoints or AngularJS CDN whitelists are especially useful for real pentests. It assumes you already know alert(1) and focuses on the stuff base models miss: postMessage origin bypasses, PHP_SELF path injection, and framework-specific vectors. The routing to companion files for mXSS, DOM clobbering, and XS-Leaks is helpful when you need to go deeper without cluttering the main playbook.

skills.sh installs: 4.2K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill xss-cross-site-scripting --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: Cross-Site Scripting (XSS) — Expert Attack Playbook

AI LOAD INSTRUCTION: This skill covers non-obvious XSS techniques, context-specific payload selection, WAF bypass, CSP bypass, and post-exploitation. Assume the reader already knows <script>alert(1)</script> — this file only covers what base models typically miss. For real-world CVE cases, HttpOnly bypass strategies, XS-Leaks side channels, and session fixation attacks, load the companion SCENARIOS.md.

0. RELATED ROUTING

Extended Scenarios

Also load SCENARIOS.md when you need:

Django debug page XSS (CVE-2017-12794) — duplicate key error → unescaped exception → XSS
UTF-7 XSS for legacy IE environments (+ADw-script+AD4-)
HttpOnly bypass methodology — proxy-the-browser, session riding, CSRF-via-XSS
XS-Leaks side channel attacks — timing oracle, cache probing, performance.now() measurement
Session fixation via XSS — pre-set session ID before victim login
DOM clobbering techniques for CSP-restricted environments

Advanced Tricks

SKILL.md on GitHub

Details

Repository: github.com/yaklang/hack-skills
Categories: Frontend Development, Security
First seen: May 16, 2026

beautiful-articleconardli/garden-skills把用户提供的素材（网页 URL / PDF / DOCX / Markdown / 纯文本 / 截图 / 粘贴材料）编辑、设计成一篇美丽的、可离线打开和分享的**单文件 HTML 网页文章**。基于 reacticle 组件协议：不手写裸 HTML/CSS，而用语义组件 + 受主题约束的 Raw 自由层；按 sourc4.1Kskills.sh installs

copilotsassistant-ui/skillsGrounding an assistant in your app with assistant-ui copilots (@assistant-ui/react). Use when steering assistant behavior with useAssistantInstructions, feeding4.1Kskills.sh installs

tailwindcsshairyf/skillsTailwind CSS utility-first CSS framework. Use when styling web applications with utility classes, building responsive designs, or customizing design systems wit4.1Kskills.sh installs

gsap-framer-scroll-animationgithub/awesome-copilotUse this skill whenever the user wants to build scroll animations, scroll effects, parallax, scroll-triggered reveals, pinned sections, horizontal scroll, text 4Kskills.sh installs

tanstack-starttanstack-skills/tanstack-skillsFull-stack React framework powered by TanStack Router with SSR, streaming, server functions, and deployment to any hosting provider.4Kskills.sh installs

preview-devstarchild-ai-agent/official-skillsFrontend & fullstack development with live preview. Use when the user wants to build a web page, frontend app, fullstack project, or any web UI — including Reac4Kskills.sh installs