Bypassing XSS Defenses Part 1: Finding Allowed Tags and Attributes

This post intends to serve as a guide for a common bypass technique when you're up against a web application firewall (WAF). In the event that the WAF limits what tags and attributes are allowed to be passed, we can use BurpSuite's Intruder functionality to learn which tags are allowed. Table of Contents: Setting the…

JCP, Free Full-Text

WSTG - Latest OWASP Foundation

Reflected XSS using Double Encoding - HACKLIDO

Bypassing XSS Defenses Part 1: Finding Allowed Tags and Attributes

Understanding XSS Attacks

Bypassing Signature-Based XSS Filters: Modifying HTML - PortSwigger

JCP, Free Full-Text

Full article: Case Study: Extenuation of XSS Attacks through Various Detecting and Defending Techniques

CSP and Bypasses

Mitigate cross-site scripting (XSS) with a strict Content Security Policy (CSP), Articles

Advanced Techniques to Bypass & Defeat XSS Filters, Part 1 « Null Byte :: WonderHowTo