XSS learning path

Orientation and first principles — what the bug class is and how it behaves.

1. Beyond XSS: Mutation XSS Explained
   7 min readaszx87410.github.io2026
   Writeup detailing mutation XSS (mXSS) techniques that exploit browser HTML parsing inconsistencies to bypass sanitizers like DOMPurify. It explains how malformed HTML within SVG and style tags can be mutated by browsers, leading to unexpected DOM structures that allow arbitrary code execution through attributes. The article references a specific DOMPurify vulnerability fixed in version 2.0.1.
2. How to Find XSS Vulnerabilities: Practical Security Guide
   9 min readhackerone.com2026
   Library detailing Cross-Site Scripting (XSS) vulnerabilities, covering reflected, stored, and DOM-based types. It provides practical techniques for manual and automated discovery, recommending tools like Dalfox, XSStrike, and xsshunter, alongside payload resources such as PayloadsAllTheThings and HackTricks. Specific examples include blind XSS in admin dashboards and stored XSS in GitLab wikis, emphasizing the use of polyglots and callback platforms for effective exploitation.
3. Hunting for Blind XSS Vulnerabilities: A Complete Guide
   7 min readintigriti.com2026
   Guide on hunting blind XSS vulnerabilities, this resource details techniques for identifying and exploiting these elusive injection flaws. It covers setting up necessary tooling, including XSSHunter, and provides a range of advanced payloads for injecting external scripts via SVG, image tags, input tags with autofocus, and JavaScript protocols, as well as bypassing Content Security Policy with base tags and exploiting AngularJS. The guide also highlights key areas to test, such as feedback forms and analytics engines.
4. Full Disclosure: DOM-Based XSS And Failures In Bug Bounty Hunting
   8 min readkuldeep.io2026
   Writeup detailing a DOM-based XSS vulnerability discovered in a bug bounty hunt, where an insecure `eUrl` parameter on a login page allowed for dynamic resource loading from an attacker-controlled server. This flaw, combined with the absence of the HTTPOnly flag on the `ASPSESSIONID` cookie, enabled a one-click account takeover. The writeup emphasizes the importance of input validation, sanitization, allow-listing, CSP, and proper cookie flag implementation to mitigate such risks.
5. Intigriti July 2025 XSS Challenge — Jorian Woltjer
   12 min readjorianwoltjer.com2026
   Library for bypassing XSS filters, leveraging DOM clobbering and Mutation XSS techniques. It demonstrates how to exploit HTML parsing quirks, specifically "foster parenting" within table elements and "node flattening," to manipulate the DOM and override critical elements like `chat-messages`. The library also showcases a method to bypass Content Security Policy (CSP) by exploiting a Socket.IO polling endpoint, reflecting input in a way that allows JavaScript execution.

Real testing methodology, tooling, and writeups that show the work.

1. Exploiting Auth0 Defaults in XSS Attacks - elttam
   8 min readelttam.com2026
   Writeup detailing how XSS vulnerabilities in applications using Auth0 can be exploited. The article highlights the insecure implicit grant flow, enabled by default in Auth0, and demonstrates how it can be combined with other misconfigurations to pivot across tenant applications. Specifically, it shows how an attacker can leverage XSS to steal access tokens intended for a protected API, facilitating lateral movement within an Auth0 tenant.
2. Finding DOM Polyglot XSS in PayPal the Easy Way
   6 min readportswigger.net2026
   Library for discovering DOM-based polyglot XSS vulnerabilities. It details a process utilizing Burp Suite's embedded browser and DOM Invader to identify insecure sinks, specifically on PayPal. The library also demonstrates how to bypass Content Security Policy (CSP) by exploiting unintended script gadgets within the PayPal application, including leveraging older versions of Bootstrap and a custom `youtube.js` gadget to execute JavaScript.
3. Advanced XSS: Bypassing Filters, CSP, and DOM-based XSS
   24 min readgithub.com2026
   Library detailing advanced Cross-Site Scripting (XSS) techniques. It covers bypassing filters, Content Security Policy (CSP), and DOM-based XSS, including 2025 attack vectors, AI agent weaponization, polymorphic payloads, sanitizer bypasses, and advanced CSP evasion via CSS and cache. Specific techniques discussed include mutation XSS (mXSS), WebAssembly, Trusted Types, prompt-to-XSS, DOMPurify mutation XSS bypasses (CVE-2025-26791), nonce leakage, postMessage exploitation, Cross-Site WebSocket Hijacking (CSWSH), GraphQL injection to XSS, payload fragmentation, evolved DOM clobbering (CVE-2025-1647), Server-Sent Events (SSE) injection, and Console/DevTools XSS.
4. Arista Firewall XSS to RCE Chain
   5 min readbishopfox.com2026
   Writeup detailing the exploitation chain of CVE-2025-6980, CVE-2025-6979 (an XSS vulnerability), and CVE-2025-6978 against Arista Next Generation Firewalls. This chain allows for remote code execution by combining an XSS vulnerability that steals administrator credentials with a command injection flaw that grants root privileges, a vulnerability the vendor's patch did not fully remediate. Disabling the captive portal is suggested as a mitigation alongside upgrading to the patched software version.
5. Magento 2.3.1: Unauthenticated Stored XSS to RCE
   6 min readsonarsource.com2026
   Library detailing an unauthenticated stored XSS vulnerability in Magento 2.3.1 that can be chained with authenticated PHAR deserialization for remote code execution. The exploit targets order cancellation notes and leverages an issue in the `escapeHtmlWithLinks()` sanitization method to inject malicious JavaScript. This payload, when triggered by an administrator, allows for session hijacking and subsequent exploitation of a PHAR deserialization flaw within the WYSIWYG editor's image rendering controller, enabling arbitrary code execution.

Novel research, edge cases, and the techniques that push the class forward.

1. Chaining a DOM XSS Sink, WAF Bypass, Cross-Origin Smuggling, and SDK Abuse into One Click Account…
   8 min readinfosecwriteups.com2026
   Library for chaining DOM XSS, WAF bypass via `window.name` cross-origin smuggling, and SDK abuse to achieve one-click account takeover. The technique exploits a `javascript:` URL sink, bypasses Akamai's WAF by inserting characters between keywords and parentheses, leverages `window.name` persistence across navigations, and abuses a first-party authentication SDK to retrieve signed JWTs and live AWS STS credentials.
2. Reflected XSS: Advanced Exploitation Guide
   10 min readintigriti.com2026
   Guide to hunting and exploiting reflected XSS vulnerabilities. This guide details a three-step methodology for identifying reflection points, testing for injection possibilities by breaking out of HTML or JavaScript contexts, and crafting proof-of-concept payloads. It covers generic HTML, HTML attribute, and JavaScript contexts, offering examples such as `<script>alert(1)</script>` and `<img src=x onerror=alert(1)>`, and explains how to handle filtered inputs. The resource also distinguishes reflected XSS from stored XSS and DOM-based XSS.
3. bypassXSS: A Curated Collection of Advanced XSS Bypass Techniques
   1 min readgithub.com2026
   Collection of advanced XSS bypass techniques detailing filter types, encoding methods, DOM manipulation, HTML5 abuse, JavaScript context escapes, WAF strategies against Cloudflare and Akamai, framework-specific payloads for AngularJS and React, and CSP misconfigurations. It includes real-world bug bounty case studies and a payload repository for testing tools like DOMPurify and various WAFs.
4. Weaponizing Cross Site Scripting: When One Bug Isn't Enough
   4 min readmicrosoft.com2026
   Technique guide detailing how Cross-Site Scripting (XSS) can be weaponized by chaining it with vulnerabilities like open redirects, CSRF, weak CSP, insecure JSON logging leading to account takeover, file upload flaws for RCE, abusing administrative functions, and improper `postMessage` usage causing token leakage. It emphasizes that XSS rarely exists in isolation and attackers combine multiple weaknesses to escalate impact, making layered defenses crucial.
5. CSP Bypasses: Advanced Exploitation Guide
   9 min readintigriti.com2026
   Guide detailing Content Security Policy (CSP) bypass techniques, focusing on how misconfigurations allow for XSS exploitation. It covers scenarios like missing CSP declarations, reporting-only modes, non-restrictive directives such as wildcards (`*`) and `unsafe-inline` in `script-src`, and leveraging third-party hosts. The guide references tools like Google CSP Evaluator and common CSP directives, emphasizing that CSP bypasses are typically report-worthy when chained with an actual vulnerability.
6. GreHack 2024 | Playing with HTML parsing to bypass DOMPurify on default configuration
   6 min readslides.com2024
   Slides from GreHack 2024 detail techniques for bypassing DOMPurify's default configuration through HTML parsing manipulation. The presentation covers exploiting DOMPurify versions 2.0.0, 3.0.0, 3.1.0, 3.1.1, and 3.1.2, demonstrating vulnerabilities related to node flattening, insertion modes, namespace switching, DOM clobbering, and attribute sanitization. It highlights specific bypasses achieved by leveraging HTML integration points, nested structures, and mutated elements to achieve cross-site scripting.
7. Advanced XSS Filter Bypass Methods Using Payload Splitting
   medium.com2026
   Advanced XSS Filter Bypass Methods Using Payload Splitting
8. Bypassing DOMPurify with Good Old XML
   5 min readflatt.tech2026
   Writeup detailing DOMPurify bypasses found by exploiting parsing inconsistencies between XML and HTML for Processing Instructions (`<?...?>`) and CDATA sections (`<![CDATA[...]]>`). The first bypass leveraged the differing interpretation of Processing Instructions, allowing arbitrary `nodeName` injection. A subsequent bypass exploited how HTML parsers handle CDATA sections outside SVG/MathML, treating them as bogus comments ending with `>` instead of `]]>`. These vulnerabilities were addressed by updates to DOMPurify's node filtering.