Get the Whitepaper called XSS Street-Fight: The Only Rule Is There Are No Rules.
You can download it from the following link: https://packetstormsecurity.com/files/download/97819/xss-streetfight.pdf
Source: https://packetstormsecurity.com/files/97819/XSS-Street-Fight-The-Only-Rule-Is-There-Are-No-Rules.html