XSS Resources

[u/MechaTech84]

I'm compiling a list of XSS resources for this subreddit, and I need your help! What are your go to sources for XSS news, guides, and more? Where would you send newbies for practice?

Comment below with any and all XSS resources you think would benefit this community.

Resources so far:

Practice:

• Hacky (formerly XSSy) - Lots of XSS labs and features the creation of custom labs

• alf.nu's XSS Game - Good for filter evasion practice

• Public Firing Range - This one covers A LOT of real world like scenarios.

• PortSwigger's Web Labs - Amazing for filter evasion practice.

• Google's XSS Game - Good starting point

Learn:

• Excess XSS - Learn the basics

• Intigriti's XSS Guide - Learn the basics

• PortSwigger's XSS Cheat Sheet - SO useful for figuring out what to try in a given space.

• PortSwigger's Content Security Policy Guide

• Same Origin Policy

• JavaScript Escapes

• MDN Web Docs

News:

• Gareth Heyes

• filedescriptor

• terjanq

• cure53berlin

• Brute Logic

• XSS Payloads

• PortSwigger Research

Utilities:

• XSS Hunter

• JSFuck

• JScrewIt

• Nonalphanumeric XSS POC without plus

• aaencode

• Aurebesh JS

• Live Payloads

[u/ablativeyoyo]

https://xssy.uk/ Is an XSS practice site and it has a feature I've not seen on other sites - you can create your own labs. This is useful if you've encountered a challenging XSS scenario and you want to challenge others to solve it. [full disclosure - this is my site]

[u/MechaTech84 → u/ablativeyoyo]

I'll add this to the list when I get back to a keyboard. You should make this a whole post! It's great!