Portswigger Academy Cross-site scripting Labs

Introduction

What?

XSS is so prevalent that, year after year, it shows up in OWASP’s list of the top 10 vulnerabilities threatening web applications.

Why?

An XSS vulnerability occurs when attackers can execute custom scripts on a victim’s browser. If an application fails to distinguish between user input and the legitimate code that makes up a web page, attackers can inject their own code into pages viewed by other users. The victim’s browser will then execute the malicious script, which might steal cookies, leak personal information, change site contents, or redirect the user to a malicious site. These malicious scripts are often JavaScript code but can also be HTML, Flash, VBScript, or anything written in a language that the browser can execute.

How?

• Cross-site scripting (XSS) techniques

• Open redirection techniques

• Reflected XSS into HTML context with nothing encoded

• Stored XSS into HTML context with nothing encoded

• DOM XSS in document.write sink using source location.search

• DOM XSS in innerHTML sink using source location.search

• DOM XSS in jQuery anchor href attribute sink using location.search source

• DOM XSS in jQuery selector sink using a hashchange event

• Reflected XSS into attribute with angle brackets HTML-encoded

• Stored XSS into anchor href attribute with double quotes HTML-encoded

• Reflected XSS into a JavaScript string with angle brackets HTML encoded

• DOM XSS in document.write sink using source location.search inside a select element

• DOM XSS in AngularJS expression with angle brackets and double quotes HTML-encoded

• Reflected DOM XSS

• Stored DOM XSS

• Exploiting cross-site scripting to steal cookies

• Exploiting cross-site scripting to capture passwords

• Exploiting XSS to perform CSRF

• Reflected XSS into HTML context with most tags and attributes blocked

• Reflected XSS into HTML context with all tags blocked except custom ones

• Reflected XSS with some SVG markup allowed

• Reflected XSS in canonical link tag

• Reflected XSS into a JavaScript string with single quote and backslash escaped

• Reflected XSS into a JavaScript string with angle brackets and double quotes HTML-encoded and single quotes escaped

• Stored XSS into onclick event with angle brackets and double quotes HTML-encoded and single quotes and backslash escaped

• Reflected XSS into a template literal with angle brackets, single, double quotes, backslash and backticks Unicode-escaped

• Reflected XSS with event handlers and href attributes blocked

• Reflected XSS in a JavaScript URL with some characters blocked

• Reflected XSS with AngularJS sandbox escape without strings

• Reflected XSS with AngularJS sandbox escape and CSP

• Reflected XSS protected by very strict CSP, with dangling markup attack

• Reflected XSS protected by CSP, with CSP bypass