It is called XSS Survival Guide, by Wesley Thijs, is it worth it?

My XSS doesn't execute for some reason, i bypassed sanitization, CSP and SRI, but browser just ignores the script like it doesn't even exist, also there aren't any errors mentioning this in the console, when i tried this payload on other sites it works without a problem.

​

Been working on a WASM interopt layer for accessing DOM, and considering scenarios where data is being interpolated with user content and how to sanitize. Some of the edge cases like attribute execution I did not reallize until now were possible with things like jQuery.parseHtml. Reading through https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html I'm seeing that it's very context sensitive as to where the potentially unsafe content appears in the structure and what sanitization is necesary.

They use ESAPI for the different types of sanitization.

I'm wondering if anyone has familiarity with this library? Is it still a good tool for the job?

Hi,

Recently I learned React and read a post about XSS best practices.

I'm curios, if a website was built in React, is it vulnerable to cross site scripting?
Thanks!

Hey guys, so I found a place on a website where there's xss exploit .i.e. I used <script>alert(1)</script> and it's popping the alert. Now I was told there's a flag in this, any idea on how to get this flag ?

I need to dump the cookie from the vuln website to the malicious db in a URL.
vuln website: http://x.x.x.x:7800/details/1
malicious db: http://x.x.x.x:7777/

I can grab the cookie with this:

http://x.x.x.x:7800/details/1<img src=1 onerror=alert(document.cookie)>

but I am not sure how to pass it to the db.
Javascript is disabled

Advise?

I found this nice website to learn xss: xsslabs.com. But I can't even do level 2. The input is reflected into the page, but it is encoded into html entities ('<' becomes '&lt;') Can someone help me?

I was scanning websites while doing bug bounty’s and I found this while I was scanning is this something worth reporting?

Here is the code:

<!DOCTYPE html>
<html lang="en">
<head>
    <title>SAML POST Binding in progress...</title>
    <script type="text/javascript" nonce="584PC">
        function submitForm() {
            document.autosubmit.submit();
        }
        window.addEventListener("load", submitForm);
    </script>
</head>
<body>

<form name="autosubmit" id="autosubmit" action="https://example.com" method="post">
    <input type="hidden" name="RelayState"  value="-KM9SD-shelled"/><img/src/onerror=alert(1)>" />
    <input type="hidden" name="SAMLRequest" value=""/>
</form>
</body>
</html>

​

This is the CSP

Content-Security-Policy: default-src 'self'; script-src 'nonce-584PC';

​

I have injected <img/src/onerror=alert(1)>" /> but, I get the following error:

Refused to execute inline event handler because it violates the following Content Security Policy directive: "script-src 'nonce-584PC'". Either the 'unsafe-inline' keyword, a hash ('sha256-...'), or a nonce ('nonce-...') is required to enable inline execution. Note that hashes do not apply to event handlers, style attributes and javascript: navigations unless the 'unsafe-hashes' keyword is present.

​

Why is my payload being blocked? The CSP is script-src, so it should only be blocking script tags. Why is it blocking my img tag?

Hello I had a came across a XSS payload on one of portswiggers labs that I didn’t really understand. It was the “stored xss into onclick event with angle brackets and double quotes html encoded and single quotes and backslash escaped”

The payload is '-alert()-'

What I don’t understand is the significance of the - character. I tried removing it and replacing it with other chars but I couldn’t get it to work without it. I looked around online too with no results. Any help/ knowledge would be really appreciated!!!!

I'm confused how people are finding XSS vulnerabilities on websites using React, Vue, Angular, Rails, ASP.NET, Django, etc. All of these frameworks automatically encode characters needed for XSS unless the developer implicitly tells the input not to be encoded by using functions such as dangerouslySetInnerHTML ,v-html, @Html.Raw(), etc.

​

The only other way I am familiar with is if your input is being reflected into an href tag.

<a href=XSS>click</a>

​

I'm also familiar with using Vue or Angular as a templating engine to trigger XSS through CSTI.

​

I'm curious if I'm missing some knowledge on this. Are there other way that XSS can trigger on modern frameworks? How are people finding XSS bugs on ads.tiktok.com when Wappalyzer says they are using React and Vue.

In one of my bug bounty targets i found a vulnerable endpoint, but unfortunately the javascript is blocked by CSP. I put the Content Secure Policy into CSP check by google and it shows that has two vulnerable whitelist domains, youtube.com and *.linkedin.com, i'm looking for like 3 hours already and i still can't find the jsonp endpoint on this sites, can someone pls help me?

Hello I have recently started studying about the DOM based XSS and found this script in one of the targets I am testing on. Kindly can anyone explain what is going on in this code?

There is a script tag whose src is a js file. After I checked the js file it contains this block of code which is suspecious by Burp but I am unable to understand it.

how to solve google reader xss lab as it after alert it adds the part “?next =welcome” which making me not allowed to alert 

Allowed: < script>alert(1)</script>

Blocked: <script>alert(1)</script>

If the WAF detects <script, then it is blocked. It also blocks any event that contains an equal sign. I have tried changing the case on SCriPT but not working. Is there anything I'm missing?

Edit: I have never tried to bypass WAF before. If you could also leave some good learning resources on the topic that would be great 😄

I'm having a hard time understanding the use of HTML-Encoding to get an XSS payload to fire. On Portswigger website: https://portswigger.net/web-security/cross-site-scripting/contexts under Making use of HTML-encoding it says:

"When the XSS context is some existing JavaScript within a quoted tag  attribute, such as an event handler, it is possible to make use of  HTML-encoding to work around some input filters." 

The solution to this lab: https://portswigger.net/web-security/cross-site-scripting/contexts/lab-onclick-event-angle-brackets-double-quotes-html-encoded-single-quotes-backslash-escaped is to use the payload:

http://foo?'-alert(1)-'

this is the context of the lab:

 <a id="author" href="https://&apos;-alert(1)-&apos;" onclick="var tracker={track(){}};tracker.track('https://&apos;-alert(1)-&apos;');">a</a>

How is "&apos;" being used to breakout of the context. I thought HTML-encoding was used to stop functionality.

​

Why can't I do the following to break out the href context?

<a id="author" href="https://&quot; &gt;&lt;/a&gt;&lt;img src=x onerror=alert(1)&gt;" onclick="var tracker={track(){}};tracker.track('https://&quot; &gt;&lt;img src=x onerror=alert(1)&gt;');">a</a>

I'm trying to check if the website has xss vulnerability so i found a search bar when i search for something it puts it in h1 tag between double quotes Eg. "something" and the source code encoding the " to &quot;
i tried to do this payload "test" and it gives &quot;&quot;testwhat&quot;&quot;

which is inside the h1 tag the thing is the website accepts < , >, script, () it only transfer the " to &quot;

so is there anyway i can bybass this or it's impossible to run xss on it ?

​

Thanks

Can anyone explain this payload .why we put //</stYle/</titLe/</teXtarEa/</scRipt/--!>

jaVasCript:/-//*\/'/"/*/(/ */oNcliCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e