Writeup-CTF
  • CTF events
    • DamCTF-2021
    • N1CTF 2021
    • WANNAGAME CHAMPIONSHIP2021
      • After end
    • DefCamp CTF 21-22
  • Root-me
    • SQL Injection - Filter bypass
    • GraphQL
    • JSON Web Token (JWT) - Public key
    • LDAP injection - Blind
    • Python - Blind SSTI Filters Bypass
    • SQL Injection - Filter bypass
    • SQL Truncation
    • Page 1
    • [Root-me]PHP - Unserialize overflow
  • WebGoat
    • Injection
    • XXE
    • Broken Authentication
      • JWT Token
      • Password reset
    • Sensitive Data Exposure
      • Insecure login
    • Broken Access Control
      • Insecure Direct Object References
    • Cross Site Scripting (XSS)
    • Cross site request forgery
      • Cross-Site Request Forgeries
      • Server-Side Request Forgery
    • Client site
      • Client site filtering
      • Bypass front-end restrictions
      • HTML tampering
    • Insecure Deserialization
    • Vulnerable Components
    • Challenges
      • Admin lost password
      • Without password
      • Without account
Powered by GitBook
On this page
  • 2/ What is XSS?
  • 7/ Try It! Reflected XSS
  • 10/ Identify potential for DOM-Based XSS
  • 11/ Try It! DOM-Based XSS
  1. WebGoat

Cross Site Scripting (XSS)

PreviousInsecure Direct Object ReferencesNextCross site request forgery

Last updated 3 years ago

2/ What is XSS?

Were the cookies the same on each tab? YES

7/ Try It! Reflected XSS

10/ Identify potential for DOM-Based XSS

start.mvc#test/

11/ Try It! DOM-Based XSS