Bypassing XSS Defenses Part 1: Finding Allowed Tags and Attributes

This post intends to serve as a guide for a common bypass technique when you're up against a web application firewall (WAF). In the event that the WAF limits what tags and attributes are allowed to be passed, we can use BurpSuite's Intruder functionality to learn which tags are allowed. Table of Contents: Setting the…

XSS and CSRF with HTML5

Defending against XSS with CSP

A pen tester's guide to Content Security Policy - Outpost24

Bypassing XSS Defenses Part 1: Finding Allowed Tags and Attributes

Using an Interactive Cross-site Scripting Backdoor

Google XSS Game Exploit & Patch

Reflected XSS using Double Encoding - HACKLIDO

A Pentester's Guide to Cross-Site Scripting (XSS)

Bypassing XSS Defenses Part 1: Finding Allowed Tags and Attributes

Firefox vulnerable to trivial CSP bypass

Content Security Bypass Techniques to perform XSS

ZTWeb: Cross site scripting detection based on zero trust - ScienceDirect