Bypassing XSS Defenses Part 1: Finding Allowed Tags and Attributes

This post intends to serve as a guide for a common bypass technique when you're up against a web application firewall (WAF). In the event that the WAF limits what tags and attributes are allowed to be passed, we can use BurpSuite's Intruder functionality to learn which tags are allowed. Table of Contents: Setting the…

Full article: Case Study: Extenuation of XSS Attacks through Various Detecting and Defending Techniques

Mastering XSS: A Comprehensive Guide for Bug Bounty Hunters, by Security Lit Limited

What are some ways of protecting against cross-site scripting (XSS) injection through cookies? - Quora

How to Find XSS Vulnerability: A Step-by-Step Guide & Tools

Reflected XSS using Double Encoding - HACKLIDO

Bypassing XSS Defenses Part 1: Finding Allowed Tags and Attributes

Defending against XSS with CSP

Full article: Case Study: Extenuation of XSS Attacks through Various Detecting and Defending Techniques

Example code and XSS attacks

Do NOT use alert(1) in XSS

Securing SPAs with Trusted Types

Bypassing XSS Defenses Part 1: Finding Allowed Tags and Attributes