Skip to content
SelfSec
Join the launch listLaunch list
SelfSec
Vulnerability field guide

Cross-Site Scripting

Cross-site scripting lets attacker-controlled input run as JavaScript in a victim's browser. Here is what XSS is, how its three variants differ, and the layered defense that shuts all of them down.

6 articles 24 min total Overview to advanced techniques

Start with the overview

Cross-Site Scripting3 min read

Cross-Site Scripting, Explained: Reflected, Stored and DOM-Based XSS

Cross-site scripting lets attacker-controlled input run as JavaScript in a victim's browser. Here is what XSS is, how its three variants differ, and the layered defense that shuts all of them down.

Read the overview

Cross-Site Scripting techniques

5 focused deep-dives
  1. 02 BlindBlind XSS: When Your Payload Fires in an Admin Panel You Never See 5 min
  2. 03 DOM-BasedDOM-Based XSS: When the Vulnerability Never Touches the Server 4 min
  3. 04 Mutation (mXSS)Mutation XSS (mXSS): How the Browser's Parser Rewrites Your Sanitized HTML 6 min
  4. 05 ReflectedReflected XSS: How a URL Can Run Code in Someone Else's Browser 3 min
  5. 06 StoredStored XSS: One Injection, Every Visitor 3 min