XSS Explained with Kurukshetra

Sign in Subscribe

XSS Explained with Kurukshetra

Kurukshetra is an intentionally designed XSS-vulnerable application. XSS explained with examples and an open-source lab for practicing cross-site scripting vulnerability. The app's motto is to get hands-on experience, and you should be able to identify XSS differently. It is an open-source app and is publicly available on GitHub.

Challenge 14: XSS bypass blacklisted JS function

XSS Explained with Kurukshetra

Challenge 14: XSS bypass blacklisted JS function

This article goes into depth discussing an alternative JavaScript function, namely "confirm()". It serves as an alternative for the JavaScript "alert()" function when the latter is unavailable.

Challenge 13: XSS in HTML Anchor Tag

XSS Explained with Kurukshetra

Challenge 13: XSS in HTML Anchor Tag

Check out how a security risk can arise from an improperly configured dynamic link generation tag and which can result in XSS exploitation.

Challenge 12: XSS CSP bypass through remote payload

XSS Explained with Kurukshetra

Challenge 12: XSS CSP bypass through remote payload

Learn how to bypass a misconfigured CSP policy and how it can lead to the successful exploitation of cross-site scripting vulnerability.

Challenge 11: XSS CSP bypass through an inline script

XSS Explained with Kurukshetra

Challenge 11: XSS CSP bypass through an inline script

Learn how a misconfigured CSP can be bypassed, potentially leading to the successful exploitation of cross-site scripting vulnerability.

Challenge 10: XSS bypass backslash escape

XSS Explained with Kurukshetra

Challenge 10: XSS bypass backslash escape

Check out how the XSS can be exploited in the HTML <div> tags and learn more about <img> tag-based XSS payload.

Challenge 9: XSS in the hidden input field

XSS Explained with Kurukshetra

Challenge 9: XSS in the hidden input field

Check out how the XSS can also be exploited in hidden input parameter fields with examples.

Challenge 8: XSS bypass improper output encoding

XSS Explained with Kurukshetra

Challenge 8: XSS bypass improper output encoding

Learn how the partially implemented HTML output encoding can be bypassed for exploiting XSS vulnerability using the HTML5 attributes

Challenge 7: XSS in a dropdown list

XSS Explained with Kurukshetra

Challenge 7: XSS in a dropdown list

Learn how the XSS vulnerability can be found in other params even though it is not editable by the browser using the BurpSuite Proxy tool

Challenge 6: XSS Bypass Client-Side Blacklist Validation

XSS Explained with Kurukshetra

Challenge 6: XSS Bypass Client-Side Blacklist Validation

Learn why client-side validation cannot be trusted all the time and how it can be tampered with by using BurpSuite as a proxy for exploiting XSS

Challenge 5: XSS bypass Client-Side Length Limit

XSS Explained with Kurukshetra

Challenge 5: XSS bypass Client-Side Length Limit

Learn why client-side validation cannot be trusted all the time and how it can be tampered with by browser debugging tools for exploiting XSS

Challenge 4: XSS using HTML attribute

XSS Explained with Kurukshetra

Challenge 4: XSS using HTML attribute

Learn how the XSS payload can be crafted using HTML5 event attributes rather than using the classic <script> tag

Challenge 3: XSS bypass Blacklist HTML tags

XSS Explained with Kurukshetra

Challenge 3: XSS bypass Blacklist HTML tags

Using the XSS fundamentals learned will look at how poorly implemented input validations can be bypassed with a custom-crafted xss payload.

Challenge 2: Reflected cross-site scripting attack

XSS Explained with Kurukshetra

Challenge 2: Reflected cross-site scripting attack

You will learn about a reflected XSS and how it differs from the stored XSS. Also, I will walk you through exploiting reflected XSS.

Challenge 1: Stored cross-site scripting attack

XSS Explained with Kurukshetra

Challenge 1: Stored cross-site scripting attack

You will learn about what cross-site scripting vulnerability is, the types of cross-site scripting vulnerabilities, and how to identify a stored XSS vulnerability.

XSS Explained: Learn cross-site scripting with examples

XSS Explained with Kurukshetra Featured

XSS Explained: Learn cross-site scripting with examples

Kurukshetra is an intentionally designed XSS-vulnerable application. XSS is explained with examples, and it's an open-source lab for practicing and learning cross-site scripting vulnerabilities.