Member-only story
“The XSS Cheat Sheet That Keeps Me Up at Night”
If you think you know XSS, you haven’t seen half of these vectors. Here’s the collection that made me question everything I thought I knew about cross-site scripting.
Disclaimer: This article is for educational purposes only. Use this knowledge responsibly and only on systems you have explicit permission to test.
Last week, I found myself staring at a reflected XSS that wouldn’t fire. My standard payloads just… sat there. The application was filtering alert, script, and even onerror. I was about to give up when I remembered a vector I'd seen once in a dusty corner of the internet:
<svg><set onbegin=alert(1)>It worked.
In 2025.
On a production system.
That’s the thing about XSS — it’s not dead. It’s just evolved. And the people who stay ahead? They have a secret weapon: knowledge of the obscure.
Let me walk you through the payloads that actually work, the bypasses that break modern filters, and the weird edge cases that most hunters completely miss.
