XSS Explained - Learn cross-site scripting with examples
A beginner-friendly guide to cross-site scripting using Kurukshetra, an intentionally vulnerable XSS practice lab.
XSS Challenges
Challenge 1 - Stored cross-site scripting attack
Practice stored XSS in a vulnerable lab and learn how malicious input can be saved and shown to other users.
Challenge 2 - Reflected cross-site scripting attack
Practice reflected XSS in a vulnerable lab and learn how it differs from stored XSS during testing.
Challenge 3 - XSS bypass blacklist HTML tags
Practice bypassing weak XSS tag filters and learn why blacklist-based validation is not enough.
Challenge 4: XSS using HTML attribute
Learn how the XSS payload can be crafted using HTML5 event attributes rather than using the classic
Challenge 5: XSS bypass Client-Side Length Limit
Learn why client-side validation cannot be trusted all the time and how it can be tampered with by browser debugging tools for exploiting XSS
Challenge 6: XSS Bypass Client-Side Blacklist Validation
Learn why client-side validation cannot be trusted all the time and how it can be tampered with by using BurpSuite as a proxy for exploiting XSS
Challenge 7: XSS in a dropdown list
Learn how the XSS vulnerability can be found in other params even though it is not editable by the browser using the BurpSuite Proxy tool
Challenge 8: XSS bypass improper output encoding
Learn how the partially implemented HTML output encoding can be bypassed for exploiting XSS vulnerability using the HTML5 attributes
Challenge 9: XSS in the hidden input field
Check out how the XSS can also be exploited in hidden input parameter fields with examples.
Challenge 10: XSS bypass backslash escape
Check out how the XSS can be exploited in the HTML tags and learn more about tag-based XSS payload.
Challenge 11: XSS CSP bypass through an inline script
Learn how a misconfigured CSP can be bypassed, potentially leading to the successful exploitation of cross-site scripting vulnerability.