The newest Cross-Site Scripting (XSS) resources are on the Cross-Site Scripting (XSS) page. For a reading order instead of a date order, see the Cross-Site Scripting (XSS) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2021-12-07 2021 | Hacker Tools: How to set up XSSHunter beginner 6 min read | Tool for detecting blind XSS vulnerabilities, XSSHunter allows users to host specialized XSS probes that scan pages and send vulnerability details via email upon triggering. The article details how to set up a self-hosted instance of XSSHunter Express using Docker, configuring DNS, and running the application, enabling granular control over collected data and enhanced notification reliability. A practical example demonstrates exploiting a vulnerable XSS lab with a generated payload and observing successful exploitation reports. |
| 2021-12-07 2021 | XSS Hunter is Now Open Source Heres How to Set It Up! beginner 4 min read | Library for self-hosting XSS Hunter, an open-source tool designed to detect blind XSS vulnerabilities. The setup process involves configuring DNS, installing dependencies like Nginx and PostgreSQL, cloning the source code from GitHub, and running the API and GUI servers within tmux sessions. Requirements include a server, a Mailgun account, a domain name, and a wildcard SSL certificate. |
| 2021-11-26 2021 | Find reflected XSS candidates in source code intermediate | Find reflected XSS candidates in source code |
| 2021-11-19 2021 | Tackling Cross Site Scripting with Smart Contracts intermediate 10 min read | Library addressing Cross-Site Scripting (XSS) attacks originating from smart contracts. It details how user-supplied strings, such as store names or product descriptions in a decentralized application (dApp), can be exploited to inject malicious HTML or JavaScript. The resource discusses both front-end UI validation and the more robust approach of implementing character validation directly within the smart contract itself to prevent DOM-based XSS and protect against direct RPC call exploits. It highlights the gas costs associated with on-chain validation using tools like `eth-gas-reporter`. |
| 2021-11-13 2021 | Web Attack Cheat Sheet beginner 61 min read API Sec Bug Bounty SQLi | Cheatsheet of web attack techniques and tools, covering manual and automated methods for discovering, enumerating, scanning, monitoring, and attacking web applications. It includes techniques like SSRF, XXE, SQLi, XSS, Path Traversal, SSTI, and information disclosure, alongside tools for ASN lookups, favicon analysis, CDN IP range identification, and subdomain enumeration. Resources mentioned include Project Discovery's Chaos, ASNlookup, CloudPeler, CloudFlair, cdncheck, CloudBunny, CF-Hero, ksubdomain, OWASP Amass, subfinder, and pius. |
| 2021-11-03 2021 | Finding and Fixing DOM-based XSS with Static Analysis Attack & Defense intermediate 7 min read | Library for detecting and preventing DOM-based XSS vulnerabilities in client-side JavaScript code. This static analysis tool, built as an eslint plugin called `eslint-plugin-no-unsanitized`, parses Abstract Syntax Trees (ASTs) to identify risky assignments to `innerHTML`, `outerHTML`, and calls to `insertAdjacentHTML()`, `document.write()`, and `document.writeln()`. It distinguishes between hardcoded safe strings and potentially attacker-controlled variables, and supports integration with sanitizers like DOMPurify to reduce false positives and improve security posture for Single Page Applications and Electron applications. |
| 2021-11-02 2021 | Intigriti 1021 XSS challenge solution writeup intermediate 6 min read | Writeup of Intigriti XSS Challenge 1021, detailing a mutation XSS exploit. The challenge involved an iframe containing a PHP page that reflected user input from the `html` parameter. By carefully crafting HTML to manipulate the DOM structure and leverage how browsers auto-correct malformed HTML, the author bypassed the Content Security Policy (CSP) to inject JavaScript. The solution focused on injecting specific tags, including `<test id="intigriti">` and `<xss><te>`, to control the last four characters of the injected JavaScript's context, ultimately leading to an XSS vulnerability. |
| 2021-10-26 2021 | Content Security Policy (CSP) explained including common bypasses beginner 6 min read | Library for understanding Content Security Policy (CSP) headers, detailing their function in preventing XSS vulnerabilities by restricting resource sources. It explains key attributes like `self`, `unsafe-inline`, and `unsafe-eval`, and covers common bypass techniques such as callback manipulation, CDN file uploads, abusing existing libraries, and injection into the policy itself, referencing techniques found on Portswigger. |
| 2021-10-21 2021 | Sanitize untrusted HTML (to prevent XSS) with a configuration specified by a Whitelist. intermediate | Library for filtering untrusted HTML input to prevent XSS attacks. It controls tag and attribute usage based on a configurable whitelist, offering flexibility through extendable APIs. Installable via npm, it effectively sanitizes user-provided HTML in contexts like forums, blogs, and e-shops. |
| 2021-10-07 2021 | Is there a way to execute XSS in an HTML img tag with SVG? intermediate | Technique for XSS execution within an HTML `<img>` tag via SVG. SVG can embed CSS, which in turn can contain JavaScript. Methods include `expression(...)`, `url('javascript:...')`, and browser-specific features like Firefox's `-moz-binding`. This allows script execution in the host page's domain when user-controlled SVGs are rendered. Mitigation strategies involve Content-Security-Policy and serving SVGs in sandboxed, cross-domain iframes. |
| 2021-10-07 2021 | What content-type's execute javascript in the browser? beginner 1 min read | Reference discussing JavaScript execution based on `Content-Type` headers in browsers. It highlights that while `text/html` is the standard, some browsers (specifically IE) may execute JavaScript in other types like `application/form-data` or `text/xhtml+xml`. The entry also notes that browser behavior can be influenced by file extensions (`.htm`, `.html`), overriding MIME type expectations, particularly to handle malformed server configurations. → stackoverflow.com |
| 2021-10-04 2021 | 10 Types of Web Vulnerabilities that are Often Missed beginner 16 min read Bug Bounty IDOR SQLi SSRF | Library detailing HTTP/2 Smuggling via custom tools like `http2smugl`, XXE within Office Open XML parsers using crafted `.docx` or `.xlsx` files, and SSRF via XSS in PDF generators, often found in applications utilizing `wkhtmltopdf` or headless browsers for PDF creation. The library also covers XSS vulnerabilities within SVG file uploads, highlighting common but frequently missed attack vectors beyond the standard OWASP Top 10. → labs.detectify.com |
| 2021-08-30 2021 | Cross-Site WebSocket Hijacking (CSWSH) intermediate API Sec | Cross-Site WebSocket Hijacking (CSWSH) |
| 2021-08-21 2021 | Why u should use burp to test Path Traversal Vulnerability and also get RXSS intermediate Burp | Why u should use burp to test Path Traversal Vulnerability and also get RXSS |
| 2021-08-17 2021 | kleiton0x00/XSScope beginner 2 min read | Framework for advanced XSS and HTML Injection client-side attacks, XSScope enables XSS botnet operations, HTTP flood DDoS attacks, and automatic payload generation for bug hunting. It can hijack cameras, steal credentials, gather victim information, implement keyloggers, take screenshots, and track location. XSScope also facilitates phishing website generation for platforms like Amazon and Steam, website defacement, and DOM manipulation, including link and image changes, clickjacking, and JavaScript execution. |
| 2021-06-30 2021 | Introducing DOM Invader: DOM XSS just got a whole lot easier to find beginner 7 min read Burp | Tool for finding DOM-based XSS vulnerabilities, DOM Invader integrates with Burp Suite Professional and Community Edition. It features an "Augmented DOM" to visualize sources and sinks, simplifying the discovery of XSS flaws as if they were reflected. DOM Invader also aids in testing web-message vulnerabilities by intercepting and allowing manipulation of postMessage data, even spoofing origins and generating proof-of-concept code. → portswigger.net |
| 2021-06-11 2021 | An HTML Injection Worth 600$ Dollars beginner | A security researcher discovered an HTML injection vulnerability, earning a $600 bounty. This vulnerability allowed for the injection of HTML code into a web application, potentially leading to various malicious activities such as cross-site scripting (XSS) attacks or defacement. The discovery and subsequent reporting of this flaw highlight the importance of robust input validation and sanitization to prevent such security risks. |
| 2021-05-31 2021 | All about File upload XSS beginner | File upload XSS vulnerabilities allow attackers to inject malicious JavaScript code into files that are uploaded to a web application. This can lead to various security risks, including session hijacking, data theft, and website defacement. Attackers exploit this by uploading crafted files that, when processed or displayed by the application, execute the embedded script in the user's browser. Proper sanitization and validation of uploaded files are crucial to prevent these attacks. |
| 2021-05-06 2021 | XSS Through Parameter Pollution intermediate API Sec | This content details a cross-site scripting (XSS) vulnerability exploit achieved through parameter pollution. Attackers can leverage the manipulation of parameters within web requests to inject malicious scripts. This technique allows them to bypass certain security filters and execute XSS attacks, potentially leading to data theft or unauthorized actions within the victim's browser session. |
| 2021-05-05 2021 | the XSS Rat intermediate | The "XSS Rat" is a proof-of-concept exploit developed by security researcher "secur3b0t" that demonstrates a cross-site scripting (XSS) vulnerability. This type of vulnerability allows attackers to inject malicious scripts into websites, which can then be executed in the browsers of unsuspecting users. The exploit highlights how sensitive data could potentially be compromised. |
| 2021-04-11 2021 | Digging Deep Into Dom XSS intermediate | The content provided is titled "Digging Deep Into Dom XSS" and only includes an introduction. The introduction likely sets the stage for discussing DOM-based Cross-Site Scripting (XSS) vulnerabilities. This type of vulnerability occurs when client-side scripts manipulate the Document Object Model (DOM) in an insecure way, allowing attackers to inject malicious scripts. The introduction may highlight the importance of understanding and mitigating DOM XSS vulnerabilities to protect web applications from exploitation. |
| 2021-04-07 2021 | The Ultimate Guide to Finding and Escalating XSS Bugs | @Bugcrowd beginner | The content discusses Cross-Site Scripting (XSS), a prevalent vulnerability in web applications where attackers execute JavaScript in users' browsers. XSS severity varies from informative to critical. It is a dynamic bug class with significant implications. → bugcrowd.com |
| 2021-03-07 2021 | GitHub - theinfosecguy/QuickXSS: Automating XSS using Bash intermediate Bug Bounty | Tool for automating XSS discovery, QuickXSS chains `waybackurls`, `gau`, `gf`, and `dalfox`. Installation is available via `pip` or `pipx`, with an optional `quickxss setup --install` command to auto-install dependencies. Users can initiate scans using `quickxss scan -d <domain>`, with options for blind XSS callbacks (`-b`) and custom output filenames (`-o`). The tool also supports Docker builds and integration tests via `pytest`. |
| 2021-02-16 2021 | RenwaX23/XSSTRON: Electron JS Browser To Find XSS Vulnerabilities Automatic intermediate 1 min read | Tool for automatically finding XSS vulnerabilities while browsing. This powerful Chromium browser detects numerous XSS scenarios, including those involving POST requests. Instructions for installation involve cloning the repository, running `npm install`, and then `npm start`. Workarounds are provided for potential issues on Debian/Ubuntu, such as manual Electron installation and sandbox disabling. |
| 2021-02-14 2021 | Stored XSS in icloud.com — $5000 news | It simply contains a casual greeting wishing well-being during difficult times. |
| 2021-01-24 2021 | How JavaScript works: 5 types of XSS attacks + tips on preventing them beginner | The content discusses five types of XSS (Cross-Site Scripting) attacks in JavaScript and provides tips on preventing them. It is part of a series exploring JavaScript and its components. The focus is on understanding the vulnerabilities that can be exploited through XSS attacks and offering preventive measures to enhance security. |
| 2020-04-06 2020 | Uber Bug Bounty: Turning Self-XSS into Good-XSS – Jack Whitton intermediate 4 min read | Writeup detailing a chained exploit on Uber's Partner portal, transforming a self-XSS vulnerability into a "good-XSS" by combining it with CSRF issues in the OAuth login and logout flows. This technique leverages Content Security Policy (CSP) to control redirects, enabling an attacker to log a victim out of their session, into the attacker's account where the XSS payload executes, and then back into their own account, ultimately granting access to the victim's data. |
| 2020-04-04 2020 | s0md3v/XSStrike: Most advanced XSS scanner. intermediate 2 min read | Library for advanced Cross Site Scripting (XSS) detection. XSStrike features custom parsers, an intelligent payload generator, a powerful fuzzing engine, and a fast crawler. It analyzes responses with multiple parsers to craft guaranteed-to-work payloads by context analysis integrated with its fuzzing engine, and also scans for DOM XSS vulnerabilities. It supports WAF detection and evasion, and leverages Photon, Zetanize, and Arjun. |
| 2020-02-14 2020 | Samesite by Default and What It Means for Bug Bounty Hunters intermediate 4 min read Bug Bounty CSRF | Library of techniques and vulnerabilities impacted by `SameSite=Lax` cookie behavior, which defaults cross-origin requests to not include cookies. This change affects Clickjacking, Cross-Site Script Inclusion (XSSI), JSONP Leaks, Data Exfiltration, XSLeaks, CORS Misconfigurations, Cross-Site WebSocket Hijacking, and XSS when exploiting cross-origin responses. While intended to mitigate CSRF, the `SameSite` default introduces significant challenges for these bug classes. |
| 2020-01-31 2020 | Cross-Site Script Inclusion - A Fameless but Widespread Web Vulnerability C beginner 8 min read | Writeup detailing Cross-Site Script Inclusion (XSSI), a widespread vulnerability often overlooked by standard security checklists. It explains how XSSI exploits the same-origin policy by allowing attackers to include resources cross-domain via script tags, thereby leaking sensitive data like cookies, session IDs, or personal information. The writeup covers identification techniques, exploitation methods for various scenarios including dynamic JavaScript and JSONP, and defensive strategies. It also introduces DetectDynamicJS, a Burp Suite plugin designed to assist testers in discovering these vulnerabilities by comparing script files with and without authentication cookies. |
| 2020-01-30 2020 | Steal CSRF tokens with simple XSS intermediate 2 min read | Writeup details how a Cross-Site Scripting (XSS) vulnerability can be exploited to steal CSRF tokens, bypassing protections like HTTPOnly cookies. The technique involves crafting a malicious script that targets specific JavaScript variables holding sensitive session information, effectively demonstrating a common web application attack vector. |
| 2019-10-07 2019 | What is cross-site scripting (XSS) and how to prevent it? beginner 8 min read | Guide to cross-site scripting (XSS) vulnerabilities, detailing how attackers can compromise user interactions by injecting malicious JavaScript. It explains the mechanisms and impact of Reflected XSS, Stored XSS, and DOM-based XSS, and outlines methods for detection and prevention, including the use of Burp Suite and specific proof-of-concept payloads like `alert()` and `print()`. → portswigger.net |
| 2019-09-15 2019 | Cross-site scripting - Wikipedia beginner 15 min read | Library detailing Cross-site scripting (XSS) vulnerabilities, a common web application flaw where attackers inject client-side scripts into web pages. This allows bypassing security measures like the same-origin policy and can lead to session cookie theft and sensitive data access. The library covers non-persistent (reflected) and persistent (stored) XSS types, including examples like search engine injection and dating profile exploits, and touches upon DOM-based XSS. |
| 2019-09-11 2019 | XSS Hunter beginner | The content provided is simply the title "XSS Hunter." It appears to be a reference to a tool or concept related to Cross-Site Scripting (XSS) security testing. XSS Hunter is likely a tool used for detecting and testing XSS vulnerabilities in web applications. The tool may help security professionals identify and mitigate potential security risks related to XSS attacks. |
| 2019-09-11 2019 | The misunderstood X-XSS-Protection intermediate | The content appears to be about the X-XSS-Protection header, a security measure designed to prevent cross-site scripting attacks. It seems to suggest that this security feature may be misunderstood or underutilized. The header helps protect websites by blocking malicious scripts from being executed in the user's browser. It is important for web developers to properly configure and implement this security measure to enhance the security of their websites and protect users from potential vulnerabilities. |
| 2019-08-28 2019 | GitHub - hakluke/weaponised-XSS-payloads: XSS payloads designed to turn alert(1) into P1 intermediate 1 min read | Library of weaponized XSS payloads designed to elevate basic XSS vulnerabilities to critical impact, such as account takeover. These JavaScript files, loadable via script tags, perform sensitive functions within victim browsers on popular CMS platforms. The repository, inspired by techniques for upgrading XSS bugs from medium to critical, includes examples for direct inclusion or PHP hosting with the correct `Content-Type` header. |
| 2019-07-31 2019 | Cross Site Scripting (XSS) - Payload Generator | Nettitude Labs intermediate 4 min read | Tool for generating Cross-Site Scripting (XSS) payloads, designed to bypass output encoding and character blacklisting filters. It supports obfuscation techniques such as `eval()`, Base64, reverse strings, `String.fromCharCode()`, and hex codes. The generator also offers various injection types, including standard element attribute breakouts and specialized payloads like 0xsobky's XSS polyglot, assisting pentesters in more complex XSS scenarios and blind XSS testing. |
| 2019-05-19 2019 | XSSed my way to 1000$ | I'm Gaurav Narwani intermediate 3 min read | Writeup detailing a Synack bug bounty case study involving a reflected XSS filter bypass. The author walks through several attempts to exploit a parameter reflected within a script tag, overcoming filters for `<`, `"`, and `>` symbols. The successful payload utilized a newline character (`%0A`) and an `else` block to bypass the application's conditional logic, ultimately triggering an `alert('XSS')` and earning a $1000 bounty. |
| 2019-01-15 2019 | Excess XSS: A comprehensive tutorial on cross-site scripting beginner 21 min read | Tutorial on Cross-Site Scripting (XSS) vulnerabilities, explaining how attackers exploit websites to inject malicious JavaScript into user browsers. It details three types of XSS attacks: Persistent XSS, where malicious strings are stored in the database; Reflected XSS, where strings originate from user requests; and DOM-based XSS, with vulnerabilities in client-side code. The tutorial illustrates how attackers can steal cookies using `document.cookie`, record keystrokes with `addEventListener`, or trick users with fake login forms via DOM manipulation. |
| 2018-12-31 2018 | foospidy/payloads: Git All the Payloads! A collection of web attack payload intermediate 2 min read | Library for aggregating web attack payloads, including XSS vectors, SQL injection payloads, path traversal, and command injection. It consolidates resources from various sources like SecLists, fuzzdb, and specific CTF event logs, facilitating easier access to a wide array of attack techniques. The `get.sh` script can be used to download and decompress external payload files. |
| 2018-09-15 2018 | Into the Borg – SSRF inside Google production network | OpnSec intermediate SSRF | The content discusses a security researcher's findings of a Cross-Site Scripting (XSS) vulnerability in Google Caja, a tool for embedding code securely. The researcher reported the XSS in March 2018, and it was fixed by Google in May 2018. The article likely delves into the details of the vulnerability, its impact, and the process of reporting and fixing it within Google's production network. |
| 2018-08-14 2018 | Unleashing an Ultimate XSS Polyglot · 0xSobky/HackVault Wiki intermediate 2 min read | Polyglot is a technique for crafting cross-site scripting (XSS) payloads that execute across various injection contexts without modification. This resource details an ultimate XSS polyglot, demonstrating its effectiveness within double-quoted, single-quoted, and unquoted tag attributes, as well as within HTML comments, common HTML tags like `<svg>` and `<iframe>`, JavaScript strings, and event handlers. The polyglot utilizes clever syntax, including multi-line comments and URI schemes, to bypass common filter bypasses like `preg_replace('/\b(?:javascript:|on\w+=)/', '', PAYLOAD)`. |
| 2018-08-13 2018 | XSS Payloads beginner | The content provided is concise and simply states "XSS Payloads." This likely refers to a topic related to Cross-Site Scripting (XSS) attacks, where malicious code is injected into a website to exploit vulnerabilities. XSS payloads are the specific scripts or code used in these attacks. The summary suggests a focus on understanding and potentially mitigating XSS vulnerabilities by studying and being aware of common XSS payloads. |
| 2018-07-30 2018 | The Real Impact of Cross-Site Scripting | Dionach intermediate 7 min read | Library of techniques for weaponizing Cross-Site Scripting (XSS) vulnerabilities, demonstrating practical attack vectors. This library details how XSS can lead to account hijacking via session cookie theft, credential harvesting by serving fake login pages, and sensitive data exfiltration or unauthorized operations like fund transfers. It also covers drive-by downloads using frameworks like BeEF and OWASP Xenotix, keylogger implementation, and port scanning against internal networks, all leveraging XSS flaws in applications like OWASP Broken Web Applications' Cyclone. |
| 2018-07-30 2018 | Cross site scripting XSS beginner | Cross-Site Scripting (XSS) is a security vulnerability where attackers inject malicious scripts into web pages viewed by other users. This can lead to theft of sensitive data, session hijacking, or defacement of websites. XSS attacks can be stored, reflected, or DOM-based. Prevention methods include input validation, output encoding, and implementing Content Security Policy (CSP). Regular security audits and staying updated on security best practices are crucial to protect against XSS attacks. → slideshare.net |
| 2018-07-30 2018 | Cross Site Scripting ( XSS) beginner 6 min read | Talk on Cross-Site Scripting (XSS) vulnerabilities, detailing how attackers inject client-side code to steal cookies, access private information, or perform actions on behalf of users. It categorizes XSS into non-persistent, persistent, and DOM-based attacks and emphasizes server-side validation, sanitization, and output escaping as primary prevention methods. The talk also mentions web vulnerability scanners like Burp Suite for testing XSS flaws. → slideshare.net |
| 2018-07-15 2018 | [HTML] 666 lines of XSS vectors, suitable for attacking an API - Pastebin.c intermediate 11 min read | Library containing 666 XSS vectors, including many variations using encoded characters and different HTML elements like `<script>`, `<img>`, `<audio>`, `<video>`, `<body>`, `<svg>`, `<iframe>`, and others with various event handlers. The vectors target common injection points and bypass techniques suitable for testing API and web application security. |
| 2018-07-03 2018 | Reflected Client XSS at Amazon.com intermediate | A bug at Amazon.com enables the theft of cookies from all Amazon domains, potentially redirecting visitors to a phishing login page. This reflected client XSS vulnerability poses a serious security risk by allowing unauthorized access to user data. |
| 2018-06-27 2018 | Reflected XSS on Stack Overflow intermediate | The content discusses a Reflected XSS vulnerability discovered on Stack Overflow by @newp_th. This type of vulnerability occurs when user input is not properly sanitized and allows malicious scripts to be executed in a victim's browser. It is important for websites to implement proper input validation and output encoding to prevent such attacks. |
| 2018-06-26 2018 | How to identify whether XSS is reflected or DOM based? intermediate | The content provided is a title mentioning how to distinguish between reflected XSS and DOM-based XSS. It appears to be a Reddit post with 5 votes and 4 comments. |