Cross-Site Scripting
Cross-Site Scripting (XSS)
Learn how attackers inject malicious scripts into websites and how to find them yourself.
Beginner60 min18 lessons8 hands-on
Free account. No credit card.
You'll be able to
- ✓Understand how the browser executes injected JavaScript
- ✓Identify and exploit reflected XSS in URL parameters and form inputs
- ✓Bypass common client-side filters and basic HTML encoding
- ✓Steal cookies and explain why XSS leads to account takeover
Lessons
- 1How British Airways Lost £20 Million to 22 Lines of Code
- 2What is XSS?
- 3See it yourself: HTML tags render liveHANDS-ON
- 4The <script> tag — when HTML becomes codeHANDS-ON
- 5Your Turn: Fire Your First AlertHANDS-ON
- 6Stealing cookies with XSSHANDS-ON
- 7Tool: XSStrike
- 8Reflected XSS — Input That Bounces Back
- 9Lab Sim: Steal the Cookie — Reflected XSSHANDS-ON
- 10Stored XSS — The Payload That Stays
- 11Lab Sim: Zeddit Comment Box — Stored XSSHANDS-ON
- 12DOM XSS — The Attack the Server Never Sees
- 13Lab Sim: DOM Hash XSS — Client-Side OnlyHANDS-ON
- 14Finding XSS in the Wild
- 15Context Is Everything
- 16Filter Bypass Techniques
- 17What Actually Stops XSS
- 18Lab: Crapazon — Reflected XSSHANDS-ON
