The newest Cross-Site Scripting (XSS) resources are on the Cross-Site Scripting (XSS) page. For a reading order instead of a date order, see the Cross-Site Scripting (XSS) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2024-11-01 2024 | XSS Payloads beginner | XSS Payloads web site |
| 2024-10-03 2024 | CSP Bypass Search intermediate | CSP Bypass Search |
| 2024-09-26 2024 | Simplifying XSS Detection with Nuclei - A New Approach intermediate 4 min read | Library for simplifying XSS detection, leveraging Nuclei's headless mode and the `waitdialog` action. This technique mimics real user interactions by running JavaScript, allowing for detection of XSS payload execution via JavaScript dialogs rather than relying on complex, target-specific reflection-based string matchers. The headless approach offers higher accuracy and reduced complexity, making XSS detection more consistent across different web applications. |
| 2024-09-24 2024 | xssorRecon/xss0rRecon.sh at main · xss0r/xssorRecon beginner 25 min read Bug Bounty Recon | Library for automated web application security reconnaissance and XSS vulnerability detection. This tool streamlines the process of identifying potential XSS attack vectors by performing domain enumeration, URL crawling, parameter analysis, and utilizing specific sub-tools like HiddenParamFinder. It aims to prepare for and launch XSS detection, offering options for path-based XSS and domain input searches, and includes a guide for deploying the tool on VPS servers for continuous operation. |
| 2024-09-23 2024 | GitHub - Emoe/kxss: This a adaption of tomnomnom's kxss tool with a different output format intermediate | Tool, a Go adaptation of tomnomnom's kxss, modifies the output format for improved grepability in recon scripts. It processes URLs to identify unfiltered characters like single quotes, double quotes, and angle brackets within parameters, presenting findings in a structured URL: [param] Unfiltered: [chars] format. Installation is handled via `go get github.com/Emoe/kxss`, and usage involves piping URLs to the executable. |
| 2024-09-22 2024 | DOM-based XSS: Exploiting `document.write` with `location.search` intermediate | Cross-Site Scripting (XSS) vulnerabilities pose significant risks to web applications by allowing attackers to inject malicious scripts… |
| 2024-09-13 2024 | GitHub - xss0r/xssorRecon: Automate Recon XSS Bug Bounty beginner Bug Bounty Recon | Library for automating XSS bug bounty reconnaissance. This tool requires downloading and extracting various files, including tools and wordlists, to a single directory for proper operation. Users can access a free five-day Pro plan license from the 10th to the 15th of each month via store.xss0r.com to explore the full functionality before potential purchase. |
| 2024-09-01 2024 | Bypassing CSP via URL Parser Confusions : XSS on Netlify’s Image CDN advanced | Heyyy Everyonee, |
| 2024-08-24 2024 | Top 10 XSS Payloads beginner | Those are the most useful payloads to prove the vast majority of Cross Site Scripting (XSS) vulnerabilities out there. |
| 2024-08-22 2024 | BChecks/vulnerability-classes/injection at main · PortSwigger/BChecks · GitHub intermediate Burp RCE SQLi | BChecks collection for Burp Suite Professional and Burp Suite Enterprise Edition - PortSwigger/BChecks |
| 2024-07-30 2024 | OAuth+XSS Attack Threatens Millions of Web Users With Account Takeover news API Sec AuthN | An attack flow that combines API flaws within "log in with" implementations and Web injection bugs could affect millions of websites. → darkreading.com |
| 2024-07-22 2024 | Understanding DOM-Based XSS: Sources and Sinks intermediate | This post assumes the reader has some knowledge on HTML, JavaScript (JS), and Cross-site scripting (XSS). I still try to explain some of… |
| 2024-07-22 2024 | Best Approach to DOM XSS intermediate | First of we need to understand the nature of this vulnerability and how it occurs , then we proceed to look forward to how to detect and… |
| 2024-07-22 2024 | DOM XSS: What Is DOM-based Cross-Site Scripting And How can you Prevent it? beginner 6 min read | Library detailing DOM-based Cross-Site Scripting (DOM XSS) vulnerabilities, which affect up to 50% of websites, impacting companies like Google, Yahoo, and Amazon. It explains how this client-side vulnerability occurs when malicious JavaScript alters the Document Object Model, enabling attackers to exploit sources like `document.URL` and sinks such as `document.write` or `innerHTML` to execute arbitrary code and steal sensitive data. The resource differentiates DOM XSS from reflected and stored XSS, highlighting its client-side root cause and the necessity for client-side code sanitization and careful handling of client data. → brightsec.com |
| 2024-07-22 2024 | DOM Based XSS | Tutorial & Examples | Snyk Learn | Snyk Learn beginner 3 min read | Tutorial on DOM XSS vulnerabilities, explaining how attackers manipulate the Document Object Model with client-side code injected via user-controllable sources like `eval()`, `document.write()`, or `innerHTML` sinks. It demonstrates exploiting a personalized profile color feature by escaping URL query parameters and recommends mitigating this by directly assigning color values to `document.body.style.color`, sanitizing input with libraries like `node-esapi`, or employing Content Security Policy (CSP) with nonces. |
| 2024-07-22 2024 | DOM-Based Cross-Site Scripting (DOM XSS) Explained beginner | 👍👍👍 and subscribe for more DOM XSS tutorials: https://www.youtube.com/channel/UC2vVVgKKzN-Gb_xeaUY0o-Q?sub_confirmation=1Check out my best selling AppSec ... |
| 2024-07-22 2024 | What is DOM-based XSS (cross-site scripting)? Tutorial & Examples | Web Security Academy beginner 8 min read | Tutorial on DOM-based XSS vulnerabilities, detailing how JavaScript sources like `window.location` can pass attacker-controllable data to sinks such as `eval()` or `innerHTML`, enabling malicious JavaScript execution. It covers manual testing techniques using browser developer tools to inspect HTML and JavaScript execution sinks, and introduces Burp Suite's DOM Invader extension for automated detection. The tutorial also explores exploiting DOM XSS through various sinks like `document.write()` and `innerHTML`, including examples with third-party dependencies like jQuery's `attr()` and `$()` functions. → portswigger.net |
| 2024-07-22 2024 | DOM Based XSS | OWASP Foundation beginner 5 min read Bug Bounty | Reference detailing DOM-based XSS (Type-0 XSS), a vulnerability where client-side scripts execute unexpectedly due to malicious modifications of the DOM environment, not the HTTP response itself. It provides examples, including a `decodeURIComponent` vulnerability and the fragment-based technique to bypass server-side detection, and mentions attacks against Adobe PDF plugins. The entry also references testing tools like DOM Snitch and the DOM XSS Wiki. → owasp.org |
| 2023-12-20 2023 | XSSRF : The Matrimony of XSS and SSRF. advanced SSRF | The content discusses the concept of XSSRF, which is the combination of Cross-Site Scripting (XSS) and Server-Side Request Forgery (SSRF). This fusion poses a significant security risk by allowing attackers to manipulate server requests through XSS vulnerabilities. The term "matrimony" is used metaphorically to describe the dangerous union of these two attack vectors. The link provided likely leads to further information or resources on this topic. |
| 2023-12-05 2023 | A Bunch of Web and XSS Challenges intermediate 9 min read | Writeups detail several web application security challenges, including exploiting AngularJS in editable divs via copy-paste XSS and connection pools, bypassing Content-Type restrictions with UTF-16 and `multipart/mixed`, and achieving XSS through path manipulation and bypassing DOMPurify with crafted HTML. Techniques such as DOM clobbering and leveraging Chrome DevTools Protocol for headless mode downloads are also discussed, offering insights into overcoming common sanitization and browser security mechanisms. |
| 2023-12-01 2023 | Cookie Bugs - Smuggling & Injection intermediate 4 min read | Writeup on browser cookie encoding and web framework parsing, detailing browser behaviors like subdomain and superdomain cookie inheritance, __Host- and __Secure- prefixes, cookie ordering, and empty cookie names. It covers browser-specific issues like Chrome's `document.cookie` corruption and vulnerabilities like cookie smuggling and injection found in Java web servers (Jetty, Tomcat, Undertow) and Python frameworks (Zope, CherryPy, aiohttp, Bottle, Webob), including CVE-2023-26049 and GHSA-p26g-97m4-6q7c. |
| 2023-11-02 2023 | JS-Tap: Weaponizing JavaScript for Red Teams intermediate 12 min read | Tool for weaponizing JavaScript for red teams, JS-Tap provides a generic payload that does not require prior application knowledge or authenticated access. It operates in Trap Mode for XSS payloads, using an iframe trap for persistence, or Implant Mode for direct injection into application JavaScript files. JS-Tap instruments the client side to collect data such as IP address, OS, browser, typed user inputs, visited URLs, cookies, local and session storage, HTML code, screenshots, and XHR/Fetch API call details, which are then monitored via a web-based portal. |
| 2023-10-05 2023 | Writeups for Damn Vulnerable Web Application (DVWA) beginner SQLi | Writeups for Damn Vulnerable Web Application (DVWA) https://ift.tt/b6djesM |
| 2023-10-05 2023 | 2023 Microsoft Office XSS intermediate 3 min read | Writeup detailing a Microsoft Office XSS vulnerability discovered in Word and Office 365. This vulnerability allows attackers to embed malicious JavaScript by crafting a video title, which is then rendered insecurely within an iframe when the video is played in a document. The exploit leverages the iframe's `onload` attribute, enabling arbitrary JavaScript execution, similar to past critical Office exploits like CVE-2021-40444 and CVE-2022-30190. |
| 2023-10-05 2023 | xss\ beginner | Writeup detailing Cross-Site Scripting (XSS) techniques and payloads, including examples like `onerror` attributes, iframe `srcdoc` exploitation, OAuth state parameter manipulation for XSS via `<script>`, and Base64 encoded JavaScript payloads. It showcases bypassing filters with various HTML tags and attributes, demonstrating an XSS to Local File Inclusion (LFI) payload targeting `/etc/passwd`, and references external resources for mass injection and Microsoft Office vulnerabilities. |
| 2023-10-03 2023 | XSS to Exfiltrate Data from PDFs intermediate | XSS to Exfiltrate Data from PDFs https://ift.tt/sGqiZz6 |
| 2023-10-03 2023 | Is XSS Attack via PDF Javascript Possible? intermediate | Analysis of PDF JavaScript execution in browsers, investigating its potential for XSS attacks. The entry addresses whether JavaScript embedded within PDF documents, like the example using `app.alert`, can access browser data such as cookies or perform redirects, and whether sandboxing mechanisms prevent such actions when PDFs are opened via a web browser. → stackoverflow.com |
| 2023-10-03 2023 | PDFBox - JavaScript in PDF Document beginner 2 min read | Library for programmatically embedding JavaScript actions into PDF documents using the Apache PDFBox framework. This technique involves loading an existing PDF, creating a `PDActionJavaScript` object with the desired script (e.g., an `app.alert` command), and setting it as the document's open action before saving and closing. |
| 2023-09-26 2023 | How Could a Self-XSS end with $$$$ intermediate | How Could a Self-XSS end with $$$$ https://ift.tt/681snfM |
| 2023-09-16 2023 | 8 XSS Vulnerabilities in Azure HDInsight Allow Attackers to Deliver Malicious Payloads news | 8 XSS Vulnerabilities in Azure HDInsight Allow Attackers to Deliver Malicious Payloads https://ift.tt/yam8fue |
| 2023-09-07 2023 | Identify Cross Site Scripting Vulnerabilities with these XSS Scanning Tools beginner 12 min read | Tools for detecting Cross-Site Scripting (XSS) vulnerabilities include Burp Suite, DalFox, Detectify, XSStrike, Wapiti, Pentest-Tools.com XSS Scanner, Intruder, Security for Everyone (S4E), ZAP, XSSer, Acunetix, and Invicti. These scanners analyze web applications by simulating attacks to find injection points for malicious scripts, helping to remediate issues like Reflected XSS, Stored XSS, and DOM-based XSS. |
| 2023-08-09 2023 | Full house bundle all of our current and future courses in one beginner | https://ift.tt/f9xe58a |
| 2023-08-01 2023 | XSS Payloads on Twitter beginner | https://twitter.com/xsspayloads/status/1685889094574874624?s=12&t=lhd09Kl740jrudlSO85fxA |
| 2023-06-08 2023 | XSS Unleashed: Bypassing Filters with XLink Namespace intermediate | XSS Unleashed: Bypassing Filters with XLink Namespace https://ift.tt/IuayGmr |
| 2023-04-02 2023 | Mastering XSS: A Comprehensive Guide for Bug Bounty Hunters beginner Bug Bounty | Mastering XSS: A Comprehensive Guide for Bug Bounty Hunters https://ift.tt/tFcafTi |
| 2023-04-02 2023 | How to Hack Web Browsers with BeEF Framework intermediate | How to Hack Web Browsers with BeEF Framework https://ift.tt/r8zkdW9 |
| 2023-03-17 2023 | Bypassing Character Limit - XSS Using Spanned Payload intermediate | The content discusses bypassing character limits in XSS attacks by using a spanned payload. It suggests a method to circumvent restrictions on the length of input in XSS attacks by utilizing a span element. This technique allows attackers to inject malicious code beyond the usual character limits imposed by security measures. By exploiting this vulnerability, hackers can potentially execute harmful scripts on vulnerable websites. |
| 2023-03-16 2023 | XSS-Payloads beginner | List of XSS payloads collected since 2015 from various sources, designed to bypass Web Application Firewalls (WAF) and identify XSS vulnerabilities. While older versions of `payloads.txt` are outdated, the project directs users to the PortSwigger XSS cheat sheet for current payloads and other valuable XSS resources. |
| 2023-01-30 2023 | The XSS hunter's secret weapon beginner 1 min read | Tool for detecting and reporting blind cross-site scripting (XSS) vulnerabilities. BXSSHUNTER generates markdown reports for platforms like HackerOne and Bugcrowd, hosts payloads remotely via *.bxss.in URLs for execution tracking, and offers instant notifications on Slack, Discord, and email. It also provides a public profile page to showcase XSS hunting skills. |
| 2023-01-30 2023 | Xss beginner | The content provided is a link to a website named "XSS Report." The website likely focuses on cross-site scripting (XSS) vulnerabilities, a common security issue in web applications. XSS allows attackers to inject malicious scripts into web pages viewed by other users. The website may offer information, resources, or tools related to identifying and mitigating XSS vulnerabilities to help website owners secure their platforms against such attacks. |
| 2022-09-14 2022 | DOM-based vulnerabilities | Web Security Academy beginner 4 min read | Reference for DOM-based vulnerabilities detailing taint flow from attacker-controllable sources like `location.search` and `document.referrer` to dangerous sinks such as `eval()` and `document.body.innerHTML`. It covers preventing these vulnerabilities through input validation, sanitization, and encoding, and mentions advanced techniques like DOM clobbering. Labs are available for practical exploitation. → portswigger.net |
| 2022-06-20 2022 | Favorite tweet by @Burp_Suite news Burp | Favorite tweet: Burp Suite 2022.6 released to the Early Adopter channel. Includes grouped tabs for Repeater, connection reuse for HTTP/1 requests, and new preset scan modes. Also introduces the abili... |
| 2022-06-20 2022 | Favorite tweet by @PortSwigger intermediate Burp | Favorite tweet: Finding Client-Side Prototype Pollution (CSPP) with DOM Invader by @garethheyes - now available on the Early Adopter channel https://t.co/ut1Buup1so — PortSwigger (@PortSwigger) Jun ... |
| 2022-05-11 2022 | Favorite tweet by @Nickieyey beginner Bug Bounty | Favorite tweet: Top XSS (Cross Site Scripting) Tools : 1) BeeF 2) BlueLotus_XSSReceiver 3) xssor2 4) Xsser-Varbaek 5) Xsser-Epsylon 6) Xenotix #pentesting #ethicalhacking #cybersecurity #CyberSec #we... |
| 2022-04-14 2022 | Favorite tweet by @e11i0t_4lders0n intermediate Bug Bounty Burp | Favorite tweet: Burp Extension for XSS Thread 🧵 #bugbounty #bugbountytip #bugbountytips — Tushar Verma 🇮🇳 (@e11i0t_4lders0n) Apr 14, 2022 |
| 2022-03-18 2022 | Favorite tweet by @NandanLohitaksh intermediate Recon | Favorite tweet: Mass Blind XSS 🔥👇 By @HackerGautam ✅ One-Liner : hakrawler -plain -usewayback -wayback -url https://t.co/UWTXcbtzMq | grep "=" | egrep -iv ".(jpg|jpeg|gif|css|tif|tiff|png|ttf|woff|wo... |
| 2022-03-18 2022 | Favorite tweet by @HackerGautam intermediate Recon | Favorite tweet: Mass Blind XSS 🔥👇 ✅ One-Liner : hakrawler -plain -usewayback -wayback -url https://t.co/Tmo5ijSdeM | grep "=" | egrep -iv ".(jpg|jpeg|gif|css|tif|tiff|png|ttf|woff|woff2|ico|pdf|svg|t... |
| 2022-02-08 2022 | Favorite tweet by @manicode beginner | Favorite tweet: OWASP has released an update to the XSS Prevention CheatSheet. This is one of our most popular CheatSheets and we are taking community consultation that the draft is ready for public ... |
| 2022-01-18 2022 | CSP Inline Scripts intermediate 1 min read | Reference detailing Content Security Policy (CSP) bypass techniques, specifically addressing inline script blocking. It explains how browsers reject inline scripts like `<script> doSomething(); </script>` and event handlers like `onclick="doSomething();"` when CSP is active. The document outlines methods to allow these, including using a single-use `nonce` value, pre-computed SHA256 `hash` values, the generally discouraged `unsafe-inline` source list, and the CSP Level 3 `unsafe-hashes` attribute for event handlers. |
| 2021-12-27 2021 | Cross-examination: unveiling JavaScript injection fingerprint masking attempts advanced 4 min read | Library for managing multiple online identities, this tool focuses on advanced browser fingerprinting and session management. It enables users to create unique browser profiles with customizable settings for timezone, geolocation, WebRTC, and hardware fingerprints like Canvas and WebGL. The library also supports proxy server configuration and session restoration, allowing for persistent logins across various websites within a single identity. |