eXential XSS (Cross Site Scripting)
summary
Demonstrates concrete stored/reflected/DOM XSS exploits on a small Node + MySQL + EJS app, shows exfiltrating session cookies via an image onload to a netcat listener, changing a user password via injected requests, and chaining XSS into node-serialize RCE to create files and get an interactive reverse shell (it works). Cites vendors finding XSS in ~60% of apps, estimates ~20% of recent security bulletins involve XSS, and uses XSS Hunter, Burp and netcat as proof tools.
AI-written summary · about
chapters (28)
- 0:00Start
- 0:38History of Xss
- 3:45Hack the Box
- 10:58Sami Worm
- 11:51Demos
- 12:50Formatting Tags
- 15:34Example of Stored Xss
- 16:12Reflected Xss
- 17:39Dom Based Xss
- 19:26Controllable Input
- 23:51Xss Hunter
- 25:21Sanitizing User Input
- 26:04Blind Xss
- 27:58Cookies
- 28:15Netcat
- 31:14Strict Mode
- 33:14Change the User's Password
- 35:12Cross-Site Request Forgery Tokens
- 35:46Csp Policies
- 36:25Block Inline Scripts
- 38:52Content Security Policy Report
- 40:17Callbacks
- 41:23Remote Code Execution or Rce
- 46:56Reverse Shell
- 50:37Detecting Xss
- 53:54React
- 55:32Javascript Protocol
- 56:34Summary Xss
