Cross-Site Scripting (XSS)

Cross-site scripting is the vulnerability class that makes "don't trust the client" a rule instead of a suggestion — every reflected XSS bug ultimately...

Stored XSS is the more dangerous sibling of reflected XSS for a simple reason: the payload doesn't need a victim to click a crafted link, it just needs...

DOM-based XSS breaks the mental model the first two labs built up: there is no server-side reflection to find, because the vulnerable data flow happens...

This lab looks almost identical to the previous one on the surface — the same location.search source, the same search box, the same absence of any...

Every DOM XSS lab so far has involved raw HTML injection — breaking out of an attribute or supplying an event handler that the browser parses as...

Every DOM sink so far has fired on page load, triggered by a query parameter we could put straight in a URL and send to a victim as a link. This lab...

The first reflected lab in this series had no encoding at all, so a plain <script> tag was enough. This lab adds the first real defense we've seen:...

This lab combines two things we'd only seen separately until now: a stored injection point (the comment form's "website" field, rather than a one-shot...

This lab moves the injection point somewhere new: inside a JavaScript string literal embedded directly in the page, rather than in HTML markup or an...