Challenge 8: XSS bypass improper output encoding
Learn how the partially implemented HTML output encoding can be bypassed for exploiting XSS vulnerability using the HTML5 attributes
Posts
Challenge 7: XSS in a dropdown list
Learn how the XSS vulnerability can be found in other params even though it is not editable by the browser using the BurpSuite Proxy tool
Challenge 6: XSS Bypass Client-Side Blacklist Validation
Learn why client-side validation cannot be trusted all the time and how it can be tampered with by using BurpSuite as a proxy for exploiting XSS
Challenge 5: XSS bypass Client-Side Length Limit
Learn why client-side validation cannot be trusted all the time and how it can be tampered with by browser debugging tools for exploiting XSS
Challenge 4: XSS using HTML attribute
Learn how the XSS payload can be crafted using HTML5 event attributes rather than using the classic
Challenge 3 - XSS bypass blacklist HTML tags
Practice bypassing weak XSS tag filters and learn why blacklist-based validation is not enough.
Challenge 2 - Reflected cross-site scripting attack
Practice reflected XSS in a vulnerable lab and learn how it differs from stored XSS during testing.
Challenge 1 - Stored cross-site scripting attack
Practice stored XSS in a vulnerable lab and learn how malicious input can be saved and shown to other users.
XSS Explained - Learn cross-site scripting with examples
A beginner-friendly guide to cross-site scripting using Kurukshetra, an intentionally vulnerable XSS practice lab.
DVWA - Brute Force Attack and Prevention Explained
Learn how brute force attacks work in DVWA, what makes them dangerous, and which defenses help reduce risk.