Most people find these type of vulnerable websites by using Google dorks or they run scans on certain websites they are paid for to pentest with permission.
Google Dorks are basically search queries on Google that find the type of website you're looking for... For example:

As you can see i used the dork “.php?q=” and it came up with website links that finish in what i just Googled. This is an example of how to use Google Dorks.

Once you get the search results on Google, You can go ahead and test to see if the website is vulnerable to XSS.

Once you enter anything on the search bar you can go ahead and do CTRL+U in your browser and it will open up view source. Or just right click anywhere and select view source.
Keep in note where your search query was placed by doing CTRL+F and searching BTS.

So now we are going to go ahead and check if the server sanitizes our code or not. So we will type in <"script"> without quotes on the search query and once again check where the input was placed on view source.

Now we can see that the code went through without being blocked by the website. Which means we can go ahead and execute any code we want.
But first, We want to go ahead and make sure that the website is 100% vulnerable so we're just going to type in this on the search bar,

If it was successful the page will follow up with a pop up that might look like this.

Now we know the website is completely vulnerable and we can proceed to execute all type of code... Malicious or not. There is also different types of XSS which I'm going to explain now.
Persistent XSS = This type of XSS is when the script entered by the hacker is stored on the server. For example, If a person tries to access the search section it will execute the code you saved on the server on their machine and you can proceed to steal their cookies and stealing their accounts.

Non Persistent XSS = This type of XSS is also known as Reflected XSS, Which is the most common one these days. The code entered will be sent to the server as a HTTP Request, So let me explain... If you search something up on a vulnerable search bar it will come up like "search results for 'word' " If the server fails to block the entered code It will execute the injected script. However this type of XSS is not persistent which means only you can see the executed code.

(Jan 30, 2017 06:03 PM)Megabear Wrote:  This tutorial seems very noob friendly.
Anyone can do this to be honest by reading this tutorial.
Thanks for this information you contributed to the community.

(Jan 30, 2017 06:06 PM)The Enigma Wrote:  Excellent job Kodaz. You pretty much cover the basics for people to understand what XSS is and how does it work.

(Feb 1, 2017 11:01 AM)SpeedDemonx Wrote:  Great tutorial, Very noob friendly and easy to follow. Its great that you added the images as well.

(Feb 1, 2017 08:09 PM)EvilL0rd Wrote:  Well done brother. This helped me a lot

(Feb 2, 2017 12:51 PM)Mr. Robot Wrote:  Baha I am referring people to this thread from now on, So easy for noobs to understand.

Thanks OP