The newest Cross-Site Scripting (XSS) resources are on the Cross-Site Scripting (XSS) page. For a reading order instead of a date order, see the Cross-Site Scripting (XSS) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2018-06-26 2018 | DOM XSS Intro beginner | The post titled "DOM XSS Intro" on Reddit has received 7 votes and 1 comment. It likely introduces readers to the concept of DOM-based Cross-Site Scripting (XSS), a type of security vulnerability. The post may provide information or discussion on how this vulnerability can be exploited in web applications. |
| 2018-06-26 2018 | Reflected XSS via AngularJS Template Injection | Hostinger intermediate | The content is about a potential security vulnerability called Reflected XSS via AngularJS Template Injection. It seems to be a post on Reddit with 5 votes and 2 comments. The main focus is likely on discussing the risks and implications of this type of security issue within AngularJS applications. |
| 2018-06-26 2018 | How I Found Stored XSS in Yahoo! intermediate | The content titled "How I Found Stored XSS in Yahoo!" has garnered 17 votes and 4 comments on Reddit. |
| 2018-06-26 2018 | What is XSS? Cross-site Scripting Explained beginner | The content is a Reddit post titled "What is XSS? Cross-site Scripting Explained" with 5 votes and 0 comments. It likely discusses the concept of Cross-site Scripting (XSS), a type of security vulnerability where attackers inject malicious scripts into web pages viewed by other users. The post may explain how XSS works, its impact on web security, and ways to prevent it. |
| 2018-06-26 2018 | Self-XSS + CSRF to Stored XSS intermediate CSRF | Renwa from Kurdistan is excited to share their first write-up on infosec and Bugbounties. |
| 2018-06-26 2018 | The story behined the Strong XSS filter bypass! intermediate | The content provided is a title mentioning a strong XSS filter bypass. However, the content is incomplete as it only includes a greeting "Hi All" without any further information or details about the bypass. |
| 2018-06-26 2018 | Demonstrating Reflected versus DOM Based XSS intermediate 7 min read | Tool demonstrating DOM-based XSS using OWASP Juice Shop, contrasting its exploitation with reflected XSS in Altoro Mutual. The resource provides a malicious server for proof-of-concept cookie theft and password recovery via JWT decoding and MD5 hashing. It highlights how DOM-based XSS bypasses browser and proxy protections, making it a more potent threat than reflected XSS for practical demonstrations. |
| 2018-06-15 2018 | How i converted SSRF TO XSS in jira. intermediate SSRF | The content discusses the author's interest in Bug Bounty programs, particularly focusing on finding security vulnerabilities like Server-Side Request Forgery (SSRF) and Cross-Site Scripting (XSS) in Jira. The author highlights their dedication to discovering new and intriguing vulnerabilities, continuously improving their reconnaissance skills. The main focus is on converting an SSRF vulnerability into an XSS vulnerability within the Jira platform. |
| 2018-06-14 2018 | Respect XSS beginner 4 min read | Writeup detailing a cross-site scripting (XSS) vulnerability in Microsoft SharePoint, affecting both on-premises and online versions. The flaw leverages the "Follow Site" feature, where the `SiteName` GET parameter is reflected in JavaScript without proper encoding, allowing for payloads like `-confirm(document.domain)-`. This vulnerability was reported to Microsoft and resulted in a $2500 bounty. The writeup includes examples of vulnerable URLs and suggests Google dorking for identification. |
| 2018-06-13 2018 | How I found a stored XSS on thousands of webshops intermediate | The content discusses the discovery of a stored XSS vulnerability affecting thousands of webshops, which remains unresolved. |
| 2018-06-08 2018 | XSS using meta Tags intermediate | The content mentions an invitation to join a social platform that allows users to earn money by engaging with posts. |
| 2018-06-08 2018 | DEV XSS Protection bypass made my quickest bounty ever!! intermediate | Yeasir Arafat shares about a successful XSS attack that led to his quickest bounty ever. He highlights the importance of sharing knowledge and experiences in the cybersecurity community. |
| 2018-06-07 2018 | Paulos Yibelo - Blog: THE BIG BAD WOLF - XSS AND MAINTAINING ACCESS intermediate 5 min read | Writeup exploring advanced XSS techniques beyond cookie theft, demonstrating how to maintain access and achieve lateral movement. It details exploiting application features like OAuth integrations and the Facebook Graph API Explorer to gain persistent, high-privilege access, even against targets with strong security mitigations like HTTPOnly cookies and CSP. The article highlights common web application misconfigurations that empower client-side attacks, including issues with password resets, session fixation, and service workers, and discusses how blind XSS can lead to RCE. |
| 2018-06-06 2018 | UltimateHackers/XSStrike: XSS Scanner equipped with powerful fuzzing engine intermediate 2 min read | Library for detecting Cross Site Scripting (XSS) vulnerabilities. XSStrike features four parsers, an intelligent payload generator, a powerful fuzzing engine, and a fast crawler. It analyzes responses and crafts payloads based on context analysis and fuzzing, going beyond simple injection. Capabilities include reflected and DOM XSS scanning, WAF detection and evasion, and scanning for outdated JavaScript libraries. It integrates with tools like Photon, Zetanize, and Arjun. |
| 2018-06-05 2018 | Blind XSS for beginners beginner | The content discusses Blind XSS for beginners, addressing common questions like tool recommendations, registering in XSShunter, and techniques for exploitation. It highlights the interest in Blind XSS and the need for guidance on tools and procedures. |
| 2018-05-28 2018 | Blind XSS for beginners beginner | The content discusses Blind XSS for beginners, addressing common questions about tools, registration on XSShunter, and techniques like payload spraying. It highlights the interest and inquiries received via Twitter on these topics. |
| 2018-05-26 2018 | File upload XSS patched intermediate | The content discusses a bug bounty write-up detailing a file upload XSS vulnerability that was successfully patched. The author describes the discovery of the vulnerability, the impact it could have had, and the steps taken to responsibly disclose it to the affected party. The post highlights the importance of thorough security testing and responsible disclosure in the bug bounty community. |
| 2018-05-19 2018 | 900$ XSS in yahoo ( Recon Wins ) news | The content provided is too brief to summarize as it only includes a greeting without any additional information or context. |
| 2018-05-17 2018 | 7500$ worth DOM XSS in Facebook Mobile Site – Johns Simon – Medium intermediate | The content discusses a security researcher discovering a $7500 worth DOM-based Cross-Site Scripting (XSS) vulnerability in Facebook's mobile site while targeting Adobe's website for vulnerabilities. The researcher found that Adobe was using Facebook and Gmail logins for sign-ins, leading to the discovery of the XSS flaw. This vulnerability could potentially allow attackers to execute malicious scripts on the site. |
| 2018-05-07 2018 | XSS (Cross Site Scripting) Prevention Cheat Sheet - OWASP beginner 18 min read | Reference for preventing XSS vulnerabilities, this cheat sheet details crucial defense techniques including output encoding and HTML sanitization. It addresses specific framework gaps in React, Angular, and others, emphasizing the importance of understanding framework behaviors and potential escape hatches like `dangerouslySetInnerHTML` and `bypassSecurityTrustAs*`. The document covers context-specific encoding for HTML, HTML attributes, JavaScript (using `\xHH` format), CSS (within property values), and URLs (using `%HH` format), recommending safe sinks like `.textContent`, `.setAttribute`, and `style.property = x` when applicable. → owasp.org |
| 2018-04-30 2018 | Steal CSRF/Auth/Unique key Header with XSS intermediate CSRF | The content is about stealing CSRF, authentication, or unique key headers using Cross-Site Scripting (XSS) attacks. It suggests a method to exploit vulnerabilities in web applications by injecting malicious scripts to intercept sensitive information. This technique allows attackers to bypass security measures and gain unauthorized access to user data or perform malicious actions. It highlights the importance of protecting against XSS attacks to safeguard sensitive information and prevent unauthorized access to web applications. |
| 2017-12-12 2017 | How to Write an XSS Cookie Stealer in JavaScript to Steal Passwords « Null intermediate 8 min read | Library for creating XSS cookie stealers in JavaScript. This guide details constructing a script that injects JavaScript into a webpage to capture user cookies containing credentials. It demonstrates embedding JavaScript within HTML and using PHP on a controlled server to receive and log stolen cookie data, with a PHP test server setup for local verification. → null-byte.wonderhowto.com |
| 2017-12-02 2017 | Sniping Insecure Cookies with XSS intermediate 10 min read | Writeup details how insecure cookie flags (missing `HttpOnly` and `Secure`) coupled with a Cross-Site Scripting (XSS) vulnerability on an accounting web application allowed for the theft of JWT session tokens. The analysis demonstrates that once captured via JavaScript, these tokens, sent in custom `X-AUTH-TOKEN` headers, could be used to impersonate users, including administrators, due to the JWT's structure and the lack of a server-side token invalidation mechanism. |
| 2017-12-02 2017 | bypassing htmlentities() - Paulos Yibelo - Blog intermediate | The content provided is a title mentioning bypassing htmlentities() by Paulos Yibelo on a blog. The title suggests that the blog post likely discusses a method or technique related to bypassing the htmlentities() function. It hints at a potential security or coding topic where the author may be sharing insights on how to circumvent or work around the htmlentities() function in web development or programming. |
| 2017-03-31 2017 | HTML5 Security Cheatsheet beginner | The content provided is a title mentioning an "HTML5 Security Cheatsheet." It suggests that there may be a resource or guide available that focuses on security considerations specific to HTML5. The title implies that the cheatsheet may contain essential information, tips, or best practices related to securing HTML5 applications or websites. |
| 2017-03-07 2017 | How I Stole Plunker Session Tokens With Angular Expressions intermediate 7 min read | Writeup detailing an Angular Expression Injection vulnerability in Plunker, where user input in the description field was evaluated by AngularJS. This allowed attackers to craft malicious expressions that could steal session IDs by redirecting requests to a custom endpoint containing the ID. The vulnerability was exploited by manipulating the `session.activeBuffer.content` to embed an `<img>` tag with the session ID as a URL parameter, effectively exfiltrating the token. Plunker fixed the issue by adding the `ng-non-bindable` directive to prevent expression evaluation. |
| 2017-03-07 2017 | XSS without HTML: Client-Side Template Injection with AngularJS : netsec intermediate | The Reddit post titled "XSS without HTML: Client-Side Template Injection with AngularJS" in the netsec subreddit has garnered 177 votes and 10 comments. The post likely discusses a security vulnerability related to AngularJS that allows for client-side template injection without the use of HTML, potentially leading to cross-site scripting (XSS) attacks. The content appears to be focused on raising awareness about this security issue within the AngularJS framework. |
| 2017-03-07 2017 | Angular Template Injection Payloads intermediate | Library of Angular template injection payloads, including techniques for exploiting versions 1.3.0 through 1.6.0. This resource details payloads utilizing JavaScript and SVG for code execution, such as `{{constructor.constructor('alert(1)')()}}`, `{{7*7}}`, and SVG `<animate>` tags with `javascript:alert(1)`. It also references specific Angular issues like #14939 and #11290. |
| 2017-03-07 2017 | PortSwigger Web Security Blog: Adapting AngularJS Payloads to Exploit Real intermediate 3 min read | Writeup detailing techniques for adapting AngularJS template injection payloads to bypass filtering and encoding, specifically targeting Piwik and Uber. The article demonstrates exploiting Piwik's handling of referral queries and Uber's documentation site, showcasing payload adaptations using Unicode escapes, `concat` instead of `valueOf`, string manipulation via `toString` and array joins, and exploiting JavaScript sandbox limitations. It highlights successful exploitation against AngularJS versions 1.2.26 and 1.2.0, noting rapid patching by Uber. |
| 2017-03-07 2017 | PortSwigger Web Security Blog: XSS without HTML: Client-Side Template Injec intermediate 11 min read | Library for detecting and exploiting Angular Template Injection vulnerabilities in AngularJS applications. It details how naive usage of the popular JavaScript framework can lead to Cross-Site Scripting (XSS) by enabling the execution of Angular expressions. The library covers the development of a sandbox escape technique, specifically for Angular versions 1.3.1+ and 1.4.0+, by backdooring the `String.fromCharCode` function using `Array.prototype.join` to inject arbitrary JavaScript, including a demonstration of bypassing the Angular sanitizer. |
| 2017-03-07 2017 | ng-owasp: OWASP Top 10 for AngularJS Applications intermediate | The content discusses the OWASP Top 10, a list of critical web application security risks, and how they apply to AngularJS applications. It explores security vulnerabilities specific to AngularJS, aiming to address and mitigate these risks. The focus is on understanding and implementing security measures to protect AngularJS applications from potential threats outlined in the OWASP Top 10 list. → slideshare.net |
| 2016-05-19 2016 | What is Cross-site Scripting and How Can You Fix it? beginner 9 min read | Library summarizing Cross-Site Scripting (XSS) vulnerabilities, detailing common attack vectors like stored, reflected, and DOM-based XSS. It explains how unsanitized user input leads to JavaScript injection, enabling attackers to steal session cookies, deface websites, and perform actions like phishing and identity theft through techniques like payload injection via script tags and redirecting users to malicious URLs. → acunetix.com |
| 2016-02-10 2016 | Preventing XSS Attacks in ASP.NET MVC using ValidateInput and AllowHTML - C intermediate | The blog discusses preventing XSS (Cross Site Security) attacks in ASP.NET MVC by utilizing ValidateInput and AllowHTML features. It aims to provide insights on how to enhance security measures to mitigate XSS vulnerabilities in ASP.NET MVC applications. |