Cross Site Scripting 101

on YouTube ↗18m

" summary

Basic XSS concepts are demonstrated with an actual beginner CTF challenge and a working exploit that reads a server-only flag via client-side JavaScript and exfiltrates it. Steps show escaping out of an attribute, using an image onerror handler to reach JavaScript context, and then an XHR sequence to request the flag and POST it to an attacker-controlled endpoint. Live tools used are web tutorial CTF, RequestBin for capture, CSP Evaluator for policy checks, and a three-step XHR exfiltration payload.

AI-written summary · about

" chapters (9)

1. 0:00Start
2. 2:35Javascript Injection!
3. 3:44Contexts
4. 4:35Example
5. 7:05Reflected XSS
6. 9:52XSS mitigations
7. 10:51Web Tutorial 1
8. 11:31Under the hood
9. 13:59Payload demo

" related talks

• 01h 02meXential XSS (Cross Site Scripting)Alex Mackey · NDC Melbourne 2022
• 40mXXSS: Exotic Cross-Site Scripting vectorsBenedek Gagyi · Øredev 2019
• 33mXXSS: Exotic Cross-Site Scripting vectorsBenedek Gagyi · RuhrJS 2019
• 31m360° View of XSSSviatoslav Lohyn · QA fwdays'20 online conference
• 28mOffensive and Defensive Strategies for Client-Side JS SecurityAnand Vemuri · JSConf Budapest 2016
• 30mXXSS: Exotic Cross Site Scripting VectorsBenedek Gagyi · revo.js 2019
• 42mEverything you need to know about client-side malicious code executionLavakumar Kuppan · JSFoo 2018
• 21mXSS — From Simple to Complex!Yuriy Fedko · QA Fest 2015