XSS Generator — Cross-Site Scripting Detection
CSP is usually sold as a prevention control, but its report-uri is a detection feed most teams never wire up. Every blocked injection becomes a structured alert from the browser itself — including DOM-based attacks your server logs cannot see.
Open in Red Team Toolkit — xssXSS Generator — Cross-Site Scripting Detection
CSP is usually sold as a prevention control, but its report-uri is a detection feed most teams never wire up. Every blocked injection becomes a structured alert from the browser itself — including DOM-based attacks your server logs cannot see.
Telemetry generated
| Log source | Field / identifier | What it shows |
|---|---|---|
| Web Access Log | uri / request_body | Injection point for reflected and stored XSS. Script tags, event-handler attributes, and javascript: scheme URIs appear here on the initial request. Stored XSS appears on the write request; subsequent reads that trigger execution do not contain the payload. |
| CSP report-uri / report-to | violated-directive / blocked-uri | Violation reports sent by the BROWSER to your collector endpoint. A genuine structured detection feed that is chronically underused. Every blocked injection — including DOM-based attacks that never reach the server — generates a report with the violated directive, blocked URI, and source file. Wire this to your SIEM. |
| Proxy / DNS Log | dst_host / query_name | Exfiltration callback. A successful XSS payload exfiltrates cookies or tokens via fetch(), new Image(), or navigator.sendBeacon() to an attacker-controlled host. The outbound request appears in proxy logs and the DNS resolution appears in DNS query logs. |
| Application Database | stored_content | For stored XSS, the persisted payload in the database keeps firing for every viewer until it is removed. The database record is the ground truth for what was injected and when. |
Detection rules
title: Cross-Site Scripting Patterns in Web Request
id: c3d4e5f6-a7b8-9012-cdef-123456789012
status: experimental
description: >
Matches normalised web request fields against XSS keyword groups covering
script tags, event handlers, JavaScript schemes, and exfiltration primitives.
logsource:
category: webserver
detection:
tags_group:
- '<script'
- '</script>'
- '<iframe'
- '<svg'
handlers_group:
- 'onerror='
- 'onload='
- 'onclick='
- 'onmouseover='
- 'ontoggle='
- 'onanimationstart='
schemes_group:
- 'javascript:'
- 'vbscript:'
exfil_group:
- 'document.cookie'
- 'fetch('
- 'new Image('
- 'navigator.sendBeacon'
condition: tags_group or handlers_group or schemes_group or exfil_group
falsepositives:
- Rich-text editors submitting legitimate HTML content
- Authorised penetration testing
level: high
tags:
- attack.execution
- attack.t1059.007Evasion & counters
Event-handler payloads that avoid the literal <script> tag (e.g. <img onerror=...>).
Match the event-handler attribute pattern directly, and deploy CSP so execution is blocked regardless of how the injection is structured. The Suricata rule above covers img, svg, body, iframe, video, audio, object, embed, and details elements.
Encoding and HTML entities to hide payload syntax from signature matching.
Match on normalised fields — Suricata's http.uri and http.request_body sticky buffers decode HTML entities and URL encoding automatically before matching.
DOM-based XSS where the payload is processed entirely client-side and never reaches the server.
Server logs are blind to DOM-based XSS by definition. CSP violation reports and client-side RUM (Real User Monitoring) are the only visibility. This is exactly why wiring up the CSP report feed matters — it is the only detection channel that sees DOM-based attacks.
Exfiltrating to a domain that matches a permissive connect-src wildcard (e.g. *.example.com).
Write CSP with explicit allowlists, never wildcards. A connect-src of 'self' https://api.example.com is far stronger than https://*.example.com, which an attacker can satisfy with a subdomain takeover.
Rule tuning
Preventive control
Context-aware output encoding at the template layer eliminates the vulnerability — encode for HTML context, attribute context, JavaScript context, and URL context separately. A restrictive CSP with no unsafe-inline and an explicit connect-src allowlist contains the damage when encoding fails. HttpOnly cookies remove the most common exfiltration target by making document.cookie return an empty string.