Cross Site Scripting
From reflected alert() to full account takeover. Understand how unescaped user input turns the browser into an execution host.
Curriculum
12 parts in 5 phasesXSS: The Browser is the Database
Cross-Site Scripting turns the browser into an execution host. One unescaped string and the attacker runs JavaScript in your user session.
Reflected XSS
The most common XSS variant. A search box, an error page, a URL parameter — any input echoed back without escaping becomes a script execution point.
Stored XSS
The attacker plants a payload in the database. Every visitor who loads the affected page executes it — comments, reviews, profiles are the classic delivery channels.
DOM-based XSS
No server involved — the payload never leaves the browser. innerHTML, document.write, eval on a URL fragment — the client-side sink is the only boundary.
XSS Payload Techniques
Polyglots, mXSS, scriptless XSS. The payloads that work across filters, encoders, and sanitizers — and how to recognise them by structure, not by alert().
Blind XSS
The payload that fires later, in a different browser, inside an admin panel the attacker never sees. Blind XSS hunters, callback exfiltration, and how to weaponise a back-office injection.
Context-Based XSS Escapes
HTML entity context, JS string context, URL context, CSS context. Each context demands a different escape sequence — the attacker finds one; the defender must close all of them.
CSP Bypass Techniques
Content Security Policy is the strongest client-side defence — until it isnt. JSONP endpoints, CDN-script-based bypasses, nonce reuse, and dangling markup injection.
XSS Defense
CSP, context-aware escaping, sanitisation libraries, and the review checklist that catches what scanners miss. How to ship HTML that cannot execute attacker code.
XSS Detection & Auditing
Automated scanners, manual DOM auditing, browser extension analysis, and the CI pipeline that catches XSS before it ships. The defender toolkit beyond CSP.
XSS Case Studies
Samy (MySpace 2005) — the first XSS worm. Twitter onmouseover (2010). eBay DOM XSS (2014). British Airways/Magecart (2018). The payloads, the root causes, the post-mortems.
XSS Review & Practice
A curated set of progressively harder XSS challenges against fresh endpoints. Reflected, stored, DOM, blind — no hand-holding. The XSS course final.