XSS Attack Surface Analysis

You are assessing a web application for Cross-Site Scripting (XSS) vulnerabilities during an authorized penetration test.

**XSS Types & Detection**
- What is the difference between Reflected, Stored, and DOM-based XSS?
- Which type causes greater business impact and why?
- How does XSS differ between HTML context, attribute context, JavaScript context, and URL context?

**Finding Injection Points**
- What inputs should you test first for XSS? (search fields, comments, user profile, error messages)
- How do you test for XSS without triggering alerts? (use harmless markers before payloads)
- How do you identify the reflection context before crafting a payload?

**Payload Construction**
- How do you construct a payload for each context: HTML, attribute, JavaScript, and URL?
- Why does `<script>alert(1)</script>` fail in most modern applications and what do you use instead?
- How do you bypass HTML entity encoding? When does encoding still allow execution?

**Content Security Policy (CSP) Analysis**
- How do you read a CSP header and identify weaknesses?
- What CSP misconfigurations allow XSS despite the policy? (unsafe-inline, unsafe-eval, wildcard sources)
- How do you bypass a CSP that allows `*.cdnprovider.com`?

**Impact Escalation**
- What is the impact chain from a reflected XSS vs a stored XSS?
- How do you use XSS for session hijacking, credential theft, or CSRF?
- How does BeEF framework demonstrate XSS impact during a pentest?

Output:
- Context-based payload cheat sheet
- CSP analysis framework
- Impact description templates per XSS type (for report writing)