Bypassing XSS Defenses Part 1: Finding Allowed Tags and Attributes

This post intends to serve as a guide for a common bypass technique when you're up against a web application firewall (WAF). In the event that the WAF limits what tags and attributes are allowed to be passed, we can use BurpSuite's Intruder functionality to learn which tags are allowed. Table of Contents: Setting the…

What is cross-site scripting (XSS)?, Tutorial & examples

Firefox vulnerable to trivial CSP bypass

Filter Bypass · Issue #32 · nahsra/antisamy · GitHub

Cross Site Scripting ( XSS ) Vulnerability Payload List, by Ismail Tasdelen

Attempting to Bypass the AngularJS Sandbox from a DOM-Based Context in versions 1.5.9-1.5.11 (Part 1) - Anvil Secure

Troy Hunt: OWASP Top 10 for .NET developers part 2: Cross-Site Scripting ( XSS)

Content Security Bypass Techniques to perform XSS

Bypassing XSS Defenses Part 1: Finding Allowed Tags and Attributes

Preventing XSS Attacks

How XSS Attacks Threaten Your Website and How to Stop Them

Bypassing XSS Defenses Part 1: Finding Allowed Tags and Attributes

Bypassing XSS Defenses Part 1: Finding Allowed Tags and Attributes

Bypassing XSS Defenses Part 1: Finding Allowed Tags and Attributes