XSS Scanner
Detect common XSS vulnerabilities in HTML content
Note: This is a basic pattern-matching scanner for educational purposes. For production security testing, use professional tools like OWASP ZAP, Burp Suite, or hire security auditors.
About the XSS Pattern Scanner
This XSS scanner examines HTML you paste for injection patterns — script tags, inline event handlers, javascript: URLs and data URIs. It is pattern matching for learning, not a substitute for a security review.
An XSS scanner of this kind looks for the constructs that let injected content execute. Script tags are the obvious one; inline event handlers such as onerror and onload are the more common route in practice, since they hide inside otherwise innocuous image and anchor tags.
The patterns worth recognising are javascript: URLs in href attributes, data URIs carrying script, and event handlers on any element. Those are how a payload survives a filter that only strips script tags — which is why blocklist-based sanitising fails and allowlist-based sanitising is the standard advice.
Be clear about the limit: this matches patterns in text you paste. It does not crawl a site, test a form, or find the injection point in your code. Real defence is contextual output encoding plus a Content-Security-Policy, and real assessment needs a security review rather than a pattern matcher.
How to use the XSS Pattern Scanner
- Paste the HTML. Enter the markup or user-submitted content to examine.
- Read the findings. See which injection patterns were matched and where.
- Understand the vector. Note how event handlers and javascript: URLs bypass tag stripping.
- Fix properly. Use allowlist sanitising and output encoding, not pattern blocking.
XSS Pattern Scanner features
- Detects script tags in pasted markup
- Finds inline event handlers such as onerror and onload
- Flags javascript: URLs and script-carrying data URIs
- Explains why blocklist filtering fails
- Clear about being pattern matching, not a security audit
- Runs entirely in your browser
Frequently asked questions
Does this scan my website?
No. It matches patterns in HTML you paste. It does not crawl a site or test a form.
Which patterns are the real risk?
Inline event handlers such as onerror, and javascript: URLs. Both survive filters that only strip script tags.
Why does blocklist filtering fail?
There are too many ways to express a payload. Allowlist sanitising, which permits only known-safe markup, is the standard advice.
What actually prevents XSS?
Contextual output encoding plus a Content-Security-Policy. Input filtering alone is not sufficient.
Is this a substitute for a security review?
No. It is a learning tool for recognising patterns.