Vulnerability field guide
Cross-Site Scripting
Cross-site scripting lets attacker-controlled input run as JavaScript in a victim's browser. Here is what XSS is, how its three variants differ, and the layered defence that shuts all of them down.
6 articles24 min totalOverview to advanced techniques
Start here
<script>alert(1)</script>Step 01 · Start with the overview
Cross-Site Scripting3 min read
Cross-Site Scripting, Explained: Reflected, Stored and DOM-Based XSS
Cross-site scripting lets attacker-controlled input run as JavaScript in a victim's browser. Here is what XSS is, how its three variants differ, and the layered defence that shuts all of them down.
Read the overviewContinue the field guide
5 focused deep-divesCross-Site Scripting techniques
- 02BlindBlind XSS: When Your Payload Fires in an Admin Panel You Never See5 min
- 03DOM-BasedDOM-Based XSS: When the Vulnerability Never Touches the Server4 min
- 04Mutation (mXSS)Mutation XSS (mXSS): How the Browser's Parser Rewrites Your Sanitized HTML6 min
- 05ReflectedReflected XSS: How a URL Can Run Code in Someone Else's Browser3 min
- 06StoredStored XSS: One Injection, Every Visitor3 min