Covers: Vulnerabilities & PatchingSupply Chain & AppSecIdentity & Access ManagementData BreachesAI SecurityEndpoint & Network SecurityCloud SecurityZero-Days & ExploitsGovernance, Risk & CompliancePrivacy
PortSwigger's lab demonstrates a DOM-based cross-site scripting flaw in search blog functionality, where an innerHTML assignment writes data from location.search into a div element. The solution injects a payload into the search box whose invalid src...
A PortSwigger lab demonstrates a stored DOM cross-site scripting flaw in blog comment functionality, where the site uses JavaScript's replace() function to encode angle brackets. Because replace() with a string first argument only replaces the first...
PortSwigger's lab demonstrates a reflected DOM XSS flaw in which the server processes a request's data and echoes it in the response, and a page script then writes that reflected data to a dangerous sink. The solution injects a backslash that the site does...
This PortSwigger lab contains a DOM-based cross-site scripting vulnerability in the stock checker functionality, where the JavaScript document.write function is called with data from location.search that the user can control through the website URL. The...
This PortSwigger lab contains a DOM-based cross-site scripting vulnerability in the search query tracking functionality, where the JavaScript document.write function is called with data from location.search that the user controls through the website URL....
This PortSwigger lab contains a DOM-based cross-site scripting vulnerability in an AngularJS expression within the search functionality. AngularJS scans HTML nodes carrying the ng-app directive, and once a directive is present, JavaScript expressions...
Dangling markup injection is a technique for capturing data cross-domain when a full cross-site scripting attack is not possible, used when an application embeds attacker-controllable data into responses without filtering or escaping the > or " characters....
PortSwigger's lab presents a reflected cross-site scripting vulnerability where the site blocks common tags but fails to block some SVG tags and events. Using an Intruder payload position on the search term, all payloads returned a 400 response except the...
PortSwigger's Web Security Academy lab describes a stored cross-site scripting flaw in a comment feature, where the author name is reflected inside an onclick event handler attribute with angle brackets and double quotes HTML-encoded and single quotes and...
PortSwigger's lab reflects user input into a JavaScript URL while blocking certain characters to prevent XSS, and the solution requires calling alert with the string 1337 in the message. The exploit uses exception handling: a throw statement separated by a...
This PortSwigger Web Security Academy lab describes a reflected cross-site scripting vulnerability in search blog functionality, where the input is reflected inside a JavaScript template string with angle brackets, single and double quotes HTML-encoded and...
This PortSwigger lab contains a reflected cross-site scripting vulnerability in the search query tracking functionality, where the reflection occurs inside a JavaScript string with single quotes and backslashes escaped. Solving the lab requires a...
PortSwigger's lab presents a reflected cross-site scripting vulnerability in search query tracking functionality, where angle brackets are encoded but the reflection lands inside a JavaScript string. Solving it requires breaking out of that JavaScript...
PortSwigger's lab presents a reflected cross-site scripting vulnerability in a search function, protected by a web application firewall that blocks common XSS vectors. The goal is to bypass the WAF and call the print() function without any user...
PortSwigger's lab contains a reflected cross-site scripting vulnerability in the search query tracking functionality, where angle brackets and double quotes are HTML-encoded and single quotes are escaped. Solving it requires a payload that breaks out of...
PortSwigger's lab blocks all HTML tags except custom ones, and the solution is a reflected cross-site scripting attack that injects a custom tag with an ID of x carrying an onfocus event handler that calls the alert function. A hash appended to the URL...
PortSwigger's Web Security Academy lab describes a stored cross-site scripting vulnerability in a comment function, where the comment author's Website input is reflected inside an anchor href attribute with double quotes HTML-encoded. The solution is to...
This PortSwigger lab presents a reflected cross-site scripting vulnerability where some tags are whitelisted but all event handlers and anchor href attributes are blocked. To solve it, participants must inject a vector that calls the alert function when...
PortSwigger's lab reflects user input inside a canonical link tag while escaping angle brackets, so the intended solution injects an attribute that calls the alert function rather than a new tag. The exploit uses an access key set on the page, which...
PortSwigger's lab presents a reflected cross-site scripting vulnerability in search blog functionality where angle brackets are HTML-encoded. Solving it requires injecting an attribute that escapes a quoted attribute and calls the alert function, and the...
This PortSwigger lab presents an AngularJS sandbox escape in which the $eval function is unavailable and no strings can be used, requiring a cross-site scripting attack that executes alert without $eval. The exploit uses toString() to create a string...
This PortSwigger lab requires a cross-site scripting attack that bypasses CSP, escapes the AngularJS sandbox, and alerts document.cookie. The exploit uses the ng-focus event to trigger a focus event that bypasses CSP, then abuses the $event.path array and...
Client-side template injection occurs when applications using a client-side template framework such as AngularJS dynamically embed user input in web pages, and the framework executes any template expressions it finds, letting an attacker supply a malicious...
PortSwigger's lab demonstrates a form hijacking attack against a site using a strict CSP that blocks external subresources, exploiting a missing form-action directive to inject a button whose formaction points to an attacker-controlled exploit server. The...
This PortSwigger lab presents a reflected XSS vulnerability on a page protected by Content Security Policy, and the goal is to perform a cross-site scripting attack that bypasses the CSP and calls the alert function. The intended solution works only in...
PortSwigger's explainer describes content security policy as a browser mechanism, enabled through a Content-Security-Policy HTTP response header containing directives separated by semicolons, that restricts which resources a page can load and whether other...
Cross-site scripting (XSS) is a web security vulnerability that lets an attacker manipulate a vulnerable site into returning malicious JavaScript, which executes in a victim's browser and circumvents the same origin policy. PortSwigger describes three main...
The same-origin policy is a browser security mechanism that restricts scripts on one origin from accessing data from another origin, where an origin is defined by URI scheme, domain, and port number. The policy generally permits cross-origin loading of...
PortSwigger's lab presents a website with an insecure CORS configuration that trusts the "null" origin, and the task is to craft JavaScript that uses CORS to retrieve the administrator's API key and upload it to an exploit server. The lab is solved when...
PortSwigger's lab presents a website with an insecure CORS configuration that trusts all subdomains regardless of protocol, and the task is to craft JavaScript that uses CORS to retrieve the administrator's API key and submit it via an exploit server. The...