XSS

A beginner-friendly guide to cross-site scripting using Kurukshetra, an intentionally vulnerable XSS practice lab.

Learn practical ways to reduce cross-site scripting risk with output encoding, validation, CSP, and safer development habits.

Practice stored XSS in a vulnerable lab and learn how malicious input can be saved and shown to other users.

Practice reflected XSS in a vulnerable lab and learn how it differs from stored XSS during testing.

Practice bypassing weak XSS tag filters and learn why blacklist-based validation is not enough.

This article goes into depth discussing an alternative JavaScript function, namely “confirm()”. It serves as an alternative for the JavaScript “alert()” function when the latter is unavailable.

Check out how a security risk can arise from an improperly configured dynamic link generation tag and which can result in XSS exploitation.

Learn how to bypass a misconfigured CSP policy and how it can lead to the successful exploitation of cross-site scripting vulnerability.

Learn how a misconfigured CSP can be bypassed, potentially leading to the successful exploitation of cross-site scripting vulnerability.

Check out how the XSS can be exploited in the HTML tags and learn more about tag-based XSS payload.

Check out how the XSS can also be exploited in hidden input parameter fields with examples.

Learn how the partially implemented HTML output encoding can be bypassed for exploiting XSS vulnerability using the HTML5 attributes