The newest Cross-Site Scripting (XSS) resources are on the Cross-Site Scripting (XSS) page. For a reading order instead of a date order, see the Cross-Site Scripting (XSS) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2025-08-14 2025 | web application - Cross Site Scripting without special chars - Information intermediate | Technique for bypassing XSS filters that disallow equals signs and parentheses involves injecting null bytes (`%00`) to break string recognition and finding single-character bypasses within a restricted character set ({ : / & @ - < > \ . , ' " }). This method aims to execute JavaScript when traditional injection vectors are blocked, especially when filters lack character conversion. |
| 2025-08-14 2025 | mandatoryprogrammer/xssless: An automated XSS payload generator written in intermediate 2 min read | Tool for automated XSS payload generation. This Python script utilizes Burp proxy exports to create asynchronous, browser-friendly payloads. It supports CSRF token extraction, multipart POST requests, file uploads, and dynamic, self-propagating payloads for creating JavaScript worms. Payloads are optimized but recommend further minimization. |
| 2025-08-14 2025 | Collection of Cross-Site Scripting (XSS) Payloads ~ SmeegeSec beginner 3 min read | Collection of 298 Cross-Site Scripting (XSS) payloads, including HTML5 specific examples, suitable for fuzzing applications for reflective and persistent vulnerabilities. This resource can be used as a reference list or integrated into tools like Burp Intruder for payload submission. Payloads cover various injection techniques, including those using `javascript:`, `<script>`, `<svg>`, `<style>`, and `expression()` properties. |
| 2025-08-14 2025 | Excess XSS: A comprehensive tutorial on cross-site scripting beginner 21 min read | Tutorial detailing Cross-Site Scripting (XSS) attacks, explaining how attackers inject malicious JavaScript into websites to compromise user browsers. It covers the three main XSS types: Persistent XSS originating from the database, Reflected XSS from user requests, and DOM-based XSS exploiting client-side code. The tutorial illustrates techniques like session cookie theft via `document.cookie`, keystroke logging with `addEventListener`, and credential harvesting through fake login forms. |
| 2025-08-14 2025 | What is Cross-site Scripting and How Can You Fix it? beginner 9 min read | Guide to Cross-Site Scripting (XSS) explaining how attackers inject malicious scripts into legitimate web pages to execute code in a victim's browser. It details risks like cookie theft, website defacement, and advanced attacks such as phishing and identity theft. The guide categorizes XSS into stored, reflected, and DOM-based types, illustrating how vulnerabilities arise from unsanitized user input and providing examples of attack vectors, including using the `<script>` tag and manipulating `XMLHttpRequest`. → acunetix.com |
| 2025-08-14 2025 | Ultimate Cross Site Scripting Attack Cheat Sheet beginner | |
| 2025-08-14 2025 | HTML5 Security CheatsheetWhat your browser does when you look away... intermediate | The content seems to be about HTML5 security and what happens when a user is not actively looking at their browser. It likely discusses potential security risks or actions that browsers may take in the background related to HTML5 technology. |
| 2025-08-14 2025 | XSS (Cross Site Scripting) Prevention Cheat Sheet - OWASP beginner 18 min read | Reference detailing XSS prevention techniques, emphasizing the necessity of combining defensive measures. It highlights how modern frameworks like React and Angular mitigate XSS through templating and auto-escaping, yet points out potential vulnerabilities when these frameworks are used insecurely, such as with React's `dangerouslySetInnerHTML` or Angular's `bypassSecurityTrustAs*` functions. The guide stresses the importance of output encoding, including HTML entity, attribute, JavaScript, CSS, and URL encoding, with specific advice on safe sinks like `.textContent` and `.setAttribute`. → owasp.org |
| 2025-08-14 2025 | Reflected XSS in DVWA: An Exploit with Real-World Consequences intermediate | The content discusses a real-world exploit involving Reflected Cross-Site Scripting (XSS) in DVWA (Damn Vulnerable Web Application) with serious consequences. It highlights the impact of XSS vulnerabilities and the importance of secure coding practices to prevent such exploits. The article likely provides insights into the exploit, its implications, and ways to mitigate XSS vulnerabilities in web applications. |
| 2025-08-14 2025 | An unusual way to find XSS injection in one minute | Medium intermediate | The content appears to be about a unique method for quickly identifying cross-site scripting (XSS) vulnerabilities in web applications. The approach likely offers a rapid and efficient way to detect XSS injections within a minute, providing valuable insights into potential security weaknesses. The article may delve into the specifics of this unconventional technique and its effectiveness in identifying and mitigating XSS vulnerabilities. |
| 2025-08-14 2025 | Lab: Reflected DOM XSS | Web Security Academy intermediate 1 min read | Lab demonstrates Reflected DOM XSS by exploiting an `eval()` function call that processes an unescaped JSON response. By crafting a specific search term, `"-alert(1)}//`, and leveraging the lack of backslash escaping, the entry injects JavaScript code, causing an `alert(1)` to execute within the browser. The technique involves canceling out quotation mark escaping and commenting out the remainder of the JSON object. → portswigger.net |
| 2025-08-14 2025 | 10 Types of Web Vulnerabilities that are Often Missed - Detectify Labs beginner 16 min read SSRF XXE | Library detailing often-missed web vulnerabilities, including HTTP/2 Smuggling, XXE via Office Open XML Parsers, SSRF via XSS in PDF Generators, and XSS via SVG files. This resource explores obscure bug classes and less common delivery methods for traditional vulnerabilities, offering insights beyond the OWASP Top 10. It references research from Detectify Labs, Hakluke, Farah Hawa, Wallarm, and James Kettle, and mentions tools like http2smugl. → labs.detectify.com |
| 2025-08-14 2025 | mandatoryprogrammer/xsshunter-express: An easy-to-setup version of XSS Hunter. Sets up in five minutes and requires… intermediate 4 min read | Library for rapidly setting up XSS Hunter to detect blind cross-site scripting. This Dockerized application automates TLS/SSL certificate generation via Let's Encrypt and offers optional email notifications for payload fires, storing detailed probe data including DOM, cookies, user agent, and full screenshots. It supports correlated injections with compatible tools, secondary payload loading, and a minimized attack surface by disabling the web control panel. |
| 2025-08-14 2025 | The Ultimate Guide to Finding and Escalating XSS Bugs | @Bugcrowd intermediate | The content discusses a comprehensive guide on finding and escalating XSS (Cross-Site Scripting) bugs. It covers various techniques and tools to identify XSS vulnerabilities in web applications, including manual testing and automated scanners. The guide emphasizes the importance of understanding different types of XSS attacks and provides tips on how to effectively report and escalate these issues to maximize impact. It also highlights the significance of responsible disclosure and collaboration between security researchers and organizations to address XSS vulnerabilities promptly. → bugcrowd.com |
| 2025-08-14 2025 | Burp Suite for Pentester: HackBar intermediate 9 min read Burp XXE | Library for Burp Suite that accelerates manual penetration testing by automating payload insertion for various vulnerabilities. HackBar offers dropdown lists with pre-defined payloads for SQL Injection, Cross-Site Scripting, Local File Inclusion, XXE Injection, and OS Command Injection, streamlining the process of testing and exploiting these common web application flaws. |
| 2025-08-14 2025 | Top 25 XSS bug bounty reports intermediate | The content discusses the top 25 XSS (Cross-Site Scripting) bug bounty reports, highlighting successful findings in various platforms. It showcases real-world examples of XSS vulnerabilities discovered by security researchers through bug bounty programs. The reports cover a range of websites and applications, emphasizing the importance of identifying and reporting XSS flaws to enhance cybersecurity. The article serves as a valuable resource for understanding XSS vulnerabilities and the impact they can have on web security. → corneacristian.medium.com |
| 2025-08-14 2025 | terjanq/Tiny-XSS-Payloads: A collection of tiny XSS Payloads that can be used in different contexts.… beginner 1 min read | Library of concise XSS payloads targeting various contexts. Examples include `<svg/onload=eval(name)>` when controlling the `name` attribute, `<iframe/onload=src=top.name>` for `<iframe>` manipulation, and `<style/onload=eval(name)>` for inline style execution. The collection also features payloads utilizing `import()` for external script execution and offers deprecated payloads for specific browser versions. |
| 2025-08-14 2025 | Documenting the impossible: Unexploitable XSS labs | PortSwigger Research advanced 3 min read | Labs detailing unexploitable XSS scenarios, including challenges like unclosed tag bypasses, JavaScript variable injections with escaped characters, query string processing with `innerHTML`, attribute length limitations, frameset injections, and minimal arbitrary code execution via `alert()`. These labs, presented as challenges on the PortSwigger XSS cheat sheet, aim to solidify understanding when exploitation proves difficult, offering confidence that a vulnerability may indeed be unexploitable if matching these specific, tricky conditions. → portswigger.net |
| 2025-08-14 2025 | Samesite by Default and What It Means for Bug Bounty Hunters intermediate 4 min read Bug Bounty CSRF | Analysis of SameSite by Default's impact on bug bounty hunting reveals that while it aims to mitigate CSRF, it significantly affects other client-side vulnerabilities. Clickjacking, Cross-Site Script Inclusion (XSSI), JSONP leaks, Data Exfiltration, XSLeaks, and Cross-Site WebSocket Hijacking are all impacted due to the inability of cross-origin requests to carry cookies. While CORS misconfigurations and some XSS scenarios might have workarounds, the change fundamentally alters the landscape for exploiting these vulnerabilities. |
| 2025-08-14 2025 | Cross-Site Scripting (XSS) Cheat Sheet - 2023 Edition | Web Security Academ beginner 16 min read | Cheatsheet of Cross-Site Scripting (XSS) vectors, this resource details numerous techniques for bypassing Web Application Firewalls and filters. It categorizes vectors by event handlers like `onanimationcancel`, `onscrollend`, and `onwebkitanimationiteration`, or by consuming tags. Specific bypass methods are provided, including those avoiding parentheses, quotes, or spaces through exception handling and location hash evaluation, as well as hoisting techniques involving undefined variables, functions, and classes, and utilizing `window.name` or ES6 template strings. → portswigger.net |
| 2025-08-14 2025 | Cross Site Scripting (XSS) Payload Generator intermediate 4 min read | Library for generating obfuscated Cross-Site Scripting (XSS) payloads to bypass output encoding and character blacklisting filters. It offers various payload actions, including loading external scripts, invoking URL requests, or executing custom JavaScript snippets. Obfuscation methods include `eval()`, Base64 with `atob()`, string reversal, `String.fromCharCode()`, and hex codes. The library supports different injection types, such as breaking out of element attributes or using SVG `onload` events, and includes 0xsobky's XSS polyglot. |
| 2025-08-14 2025 | Steal CSRF tokens with simple XSS intermediate 2 min read | Writeup detailing a simple cross-site scripting (XSS) technique capable of stealing CSRF tokens. This method leverages basic XSS payloads to exfiltrate sensitive tokens, potentially leading to unauthorized actions on behalf of the user. The article highlights the importance of robust CSRF protection mechanisms in web applications to prevent such attacks. |
| 2025-08-14 2025 | XSSed my way to 1000$ | I'm Gaurav Narwani intermediate 3 min read | Writeup of a Synack bug bounty case study detailing a reflected XSS filter bypass that earned $1000+. The analysis focuses on bypassing input restrictions using character encoding like `%0A` and exploiting JavaScript execution flow by inserting an `else` block to trigger `alert('XSS')` when direct payload injection failed due to `if (false)` conditions and unclosed parentheses. |
| 2025-08-14 2025 | XSS-Payloads/Without-Parentheses.md at master · RenwaX23/XSS-Payloads intermediate 1 min read | Collection of JavaScript Cross-Site Scripting (XSS) payloads, specifically demonstrating techniques to execute `alert(23)` without using parentheses. This resource includes a wide variety of bypasses and creative methods, often leveraging unusual JavaScript features, object prototypes, and browser-specific quirks to achieve execution, such as manipulating `onerror`, `setTimeout`, `eval`, and various string manipulation techniques. |
| 2025-08-14 2025 | How to identify whether XSS is reflected or DOM based? intermediate | The content discusses methods to determine if a Cross-Site Scripting (XSS) vulnerability is reflected or DOM-based. This distinction is crucial for understanding how the attack is executed and mitigated. By analyzing the source of the vulnerability and its impact on the Document Object Model (DOM), security professionals can effectively identify and address XSS threats. Understanding the nature of XSS helps in implementing appropriate security measures to prevent exploitation and protect web applications from malicious attacks. |
| 2025-08-14 2025 | DOM XSS Intro beginner | The content is a brief introduction to DOM-based Cross-Site Scripting (XSS) without providing specific details or explanations. DOM XSS is a type of XSS attack that occurs when client-side scripts manipulate the Document Object Model (DOM) in a way that allows malicious scripts to be executed in a victim's browser. This summary captures the essence of the topic without delving into further details or examples. |
| 2025-08-14 2025 | Reflected XSS via AngularJS Template Injection | Hostinger intermediate | The content title mentions "Reflected XSS via AngularJS Template Injection" on Hostinger. This indicates a security vulnerability where attackers can inject malicious code into AngularJS templates, leading to cross-site scripting (XSS) attacks. The vulnerability allows attackers to execute scripts in the context of a user's browser, potentially compromising sensitive data or performing unauthorized actions on the affected website. It highlights the importance of securing web applications against such vulnerabilities to prevent exploitation and protect user data. |
| 2025-08-14 2025 | How I Found Stored XSS in Yahoo! intermediate | The content provided is a title stating "How I Found Stored XSS in Yahoo!". It suggests that the author discovered a stored cross-site scripting (XSS) vulnerability in Yahoo's system. The title implies that the author will likely share their experience, methodology, and findings related to identifying and exploiting this security flaw in Yahoo's platform. |
| 2025-08-14 2025 | What is XSS? Cross-site Scripting Explained beginner | Cross-site scripting (XSS) is a security vulnerability where attackers inject malicious scripts into web pages viewed by other users. This can lead to theft of sensitive information, unauthorized access, and other malicious activities. XSS exploits the trust a user has for a particular website, allowing attackers to execute scripts in the victim's browser. It is crucial for developers to implement proper security measures to prevent XSS attacks, such as input validation and output encoding. Understanding XSS and its implications is essential for maintaining the security of web applications. |
| 2025-08-14 2025 | s0md3v/AwesomeXSS intermediate 4 min read | Library of XSS resources, including challenges, tools, and payloads. It details numerous XSS vectors and bypass techniques, referencing specific sinks and sources from domxsswiki. Examples include SVG onload events, JavaScript context breaking with encoded characters, attribute injection using polyglots, and bypassing filters by omitting spaces, quotes, or the equal sign in payloads. The resource also provides methods for shortening URLs and avoiding common XSS detection keywords like "alert." |
| 2025-08-14 2025 | Demonstrating Reflected versus DOM Based XSS intermediate 7 min read | Library demonstrating DOM-based XSS exploitation in the OWASP Juice Shop, contrasting it with Reflected XSS in Altoro Mutual. The post details how to construct a malicious server to steal user cookies, extract JWTs, and retrieve password hashes, showcasing the effectiveness of DOM-based XSS against typical security measures. |
| 2025-08-14 2025 | How I found a XSS vulnerability within the response field intermediate | The content discusses how a security researcher discovered a cross-site scripting (XSS) vulnerability within a response field. The researcher explains the steps taken to identify and exploit the vulnerability, highlighting the importance of thorough testing and responsible disclosure. The article serves as a valuable resource for understanding XSS vulnerabilities and the process of reporting them for responsible disclosure. |
| 2025-04-23 2025 | Cross-Site WebSocket Hijacking Exploitation in 2025 - Include Security Research Blog intermediate 10 min read | Analysis of Cross-Site WebSocket Hijacking (CSWSH) exploitation, detailing how browser security improvements like Third Party Cookie Restrictions, Private Network Access, SameSite=Lax by default, and Firefox's Total Cookie Protection increasingly limit its effectiveness. It recaps CSWSH prerequisites, including cookie-based authentication with SameSite=None and missing Origin validation on WebSocket servers, and explores how these mitigations impact exploitability through case studies. → blog.includesecurity.com |
| 2025-04-11 2025 | XSS payloads for href beginner | XSS payloads for href. GitHub Gist: instantly share code, notes, and snippets. |
| 2025-04-09 2025 | Controlling XSS Using A Secure WebSocket CLI - InfoSec Write-ups intermediate | When experimenting with Cross-Site Scripting (XSS), what’s the quickest way to test multiple payloads efficiently? Not long ago, I set up an XSS server that serves remote payloads, which can easily… → infosecwriteups.com |
| 2025-04-01 2025 | GitHub - Leviticus-Triage/XSS_Hunter: Ein Framework zur automatisierten Erkennung und Exploitation von XSS-Schwachstellen intermediate 4 min read | Framework for automated detection and exploitation of XSS vulnerabilities. It leverages machine learning for payload generation, WAF detection and evasion, and robust vulnerability validation. Features include scan, exploit, payload, and report modes, with options for screenshots, callback servers for blind XSS, and various validation levels for accuracy. It supports authenticated scans and DOM-based XSS detection. |
| 2025-03-31 2025 | Javascript Recon for Bug Bounty & Pentesting intermediate Bug Bounty Recon | Hidden endpoints, secrets, and DOM XSS using Automated JS Analysis |
| 2025-03-30 2025 | Stored XSS in My Flow To RCE in Opera Browser #2 - Renwa - Medium intermediate Bug Bounty RCE | Hey Opera team, after your great response and bounties with previous reports motivated me to look more into the program and find more bugs, luckily I found a critical bug in My Flow that allow an… |
| 2025-02-20 2025 | How I got a Stored XSS by searching through JS files. intermediate Bug Bounty | Hello Friend, I’m gonna talk about a simple Stored XSS vulnerability I did find in a private bug bounty program at Bugcrowd by searching in… |
| 2025-02-01 2025 | Tiny XSS Payloads beginner | A collection of small XSS payloads |
| 2025-01-28 2025 | domloggerpp/.github/images/firefox_manual.png at main · kevin-mizu/domloggerpp · GitHub intermediate | A browser extension that allows you to monitor, intercept, and debug JavaScript sinks based on customizable configurations. - kevin-mizu/domloggerpp |
| 2025-01-28 2025 | Cross Site Scripting - Payloads All The Things intermediate 10 min read | Reference containing a comprehensive collection of Cross-Site Scripting (XSS) payloads and techniques. It details reflected, stored, and DOM-based XSS, offering proof-of-concept examples for data exfiltration and session hijacking, including payloads for HTML, SVG, and various HTML5 tags. The resource also lists tools like XSSStrike, xsser, Dalfox, and XSpear for identifying XSS vulnerabilities. |
| 2025-01-23 2025 | XSS Penetration Testing Tool | Advanced Web Security for Pen Testers intermediate 4 min read | Tool for automated XSS detection, supporting 4500+ payloads and WAF bypass. It handles GET and POST requests, scans all parameters, and identifies Reflected, Stored, DOM-based, and Blind XSS vulnerabilities. Features include blind XSS automation, real-time feedback on confirmed alerts and WAF detection, and generation of detailed HTML, PDF, CSV, and JSON reports. Businesses can request a 48-hour trial license. |
| 2025-01-19 2025 | Google XSS Game beginner | Warning: You are entering the XSS game area |
| 2024-12-31 2024 | GitHub - 11whoami99/XSS-keylogger: A Simple JS code to keylogger data and send it to the personal server intermediate | A Simple JS code to keylogger data and send it to the personal server - 11whoami99/XSS-keylogger |
| 2024-12-21 2024 | GitHub - Cybersecurity-Ethical-Hacker/xssdynagen: 🪄 XSSDynaGen is a tool designed to analyze URLs with parameters, identify the characters allowed by the server, and generate advanced XSS payloads based on the analysis results. intermediate 6 min read Fuzzing | Library for dynamic XSS payload generation; analyzes URLs with parameters to identify server-allowed characters and constructs advanced payloads. Features asynchronous processing, parameter character testing with canary-based reflection verification, customizable character sets, and advanced evasion techniques like null bytes and Unicode encoding. Supports batch processing, proxy routing (Burp Suite, ZAP, mitmproxy), configurable rate limiting, and automatic retries. Output includes structured JSON with detailed analysis and generated payloads, or plain text. |
| 2024-11-15 2024 | GreHack 2024 | Playing with HTML parsing to bypass DOMPurify on default configuration advanced 6 min read | Slides from GreHack 2024 detail techniques for bypassing DOMPurify's default configuration through HTML parsing manipulation. The presentation covers exploiting DOMPurify versions 2.0.0, 3.0.0, 3.1.0, 3.1.1, and 3.1.2, demonstrating vulnerabilities related to node flattening, insertion modes, namespace switching, DOM clobbering, and attribute sanitization. It highlights specific bypasses achieved by leveraging HTML integration points, nested structures, and mutated elements to achieve cross-site scripting. |
| 2024-11-13 2024 | JavaScript for Hacking Made Easy: Expert Guide beginner 24 min read | Guide to using JavaScript for ethical hacking, detailing how its client-side execution enables attacks like Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF). It introduces the browser's developer console for debugging and analysis, and demonstrates vulnerability identification using OWASP ZAP against targets like Damn Vulnerable Web Application (DVWA). |
| 2024-11-13 2024 | [HackerNotes Ep.95 & Ep.96] Cookies, Caching & Attacking Chrome Extensions with MatanBer advanced 21 min read Talks | Library for understanding and attacking browser extensions, covering components like content scripts, service workers, extension pages, and the manifest file. It details techniques for gaining source code access, exploiting extension scoping, and attacking content scripts via DOM injection and clickjacking, as well as extension and service worker pages through misconfigurations and message-passing APIs. The resource also includes insights on debugging extensions and notes on cookie parsing behaviors from the HeroV6 CTF writeup. |
| 2024-11-10 2024 | GitHub - whitel1st/docem: A tool to embed XXE and XSS payloads in docx, odt, pptx, xlsx files (oxml_xxe on steroids) intermediate 3 min read XXE | Library for embedding XXE and XSS payloads within common document formats like docx, odt, and pptx. Docem automates the process of replacing placeholder "magic symbols" in a sample document with specified payloads, offering granular control over payload placement per document, per file, or per placeholder. It serves as a more convenient alternative to tools like oxml_xxe when generating numerous poisoned documents. |
