Do not use the script tag when testing for XSS

Better advice would be to not use exploit payloads for XSS detection in the first place, IMO. I personally like @cinzinga_'s goto payload of <s>asdf since it's small, easily searchable, and the strike-through text is more noticeable.

In case your sink is innerHTML, but you still need to load <script> use this: <iframe srcdoc="<script src=''></script>"></iframe> Last time I saw this trick in @bbuerhaus article

@bbuerhaus Yes, I've used for actually exploiting the innerHTML XSS but not for detecting it.

Learnt this the hard way on hacker101 CTF

That brings me to the question that has been bugging me for a while now (Noob here) When you payload is being encoded, is that the end of the road? Cause usually i get stuck at this point

yes, encoding is a proper defence against xss and there's nothing you can do

Event handlers use need the same ''unsafe-inline' directive as inline scripts so what you say doesn't make sense.