Bypassing XSS Defenses Part 1: Finding Allowed Tags and Attributes

This post intends to serve as a guide for a common bypass technique when you're up against a web application firewall (WAF). In the event that the WAF limits what tags and attributes are allowed to be passed, we can use BurpSuite's Intruder functionality to learn which tags are allowed. Table of Contents: Setting the…

Mitigate cross-site scripting (XSS) with a strict Content Security Policy (CSP), Articles

What is cross-site scripting (XSS)?, Tutorial & examples

WSTG - Latest OWASP Foundation

PDF) Analysis of XSS attack Mitigation techniques based on Platforms and Browsers

Bypassing XSS Defenses Part 1: Finding Allowed Tags and Attributes

What is a Cross-site scripting attack? How to prevent XSS attack

5 methods for Bypassing XSS Detection in WAFs

Advanced Techniques to Bypass & Defeat XSS Filters, Part 1 « Null Byte :: WonderHowTo

Do NOT use alert(1) in XSS

Finding DOM Polyglot XSS in PayPal the Easy Way

Bypassing modern XSS mitigations with code-reuse attacks - Truesec

XSS - Attacks & Defense

Bypassing XSS Defenses Part 1: Finding Allowed Tags and Attributes