Bug Bounty Tip | Do This Exercise Every Day to Get Better at Finding XSS Bugs!

This is my favorite exercise for learning to bypass XSS filters and weaponize XSS vulns in Public Bug Bounty Programs!

First, we build a Cross-Site Scripting (XSS) bug into a small web application. This forces us to understand exactly what an XSS vuln is and how it is introduced.

Next, look at a variety of payload options and see what XSS payloads work, depending on where the payload is reflected in the DOM.

After we have a working payload that allows us to weaponize the vulnerability, we "switch gears" and act as the developer tasked with remediation.  Here, we research how to remediate XSS vulnerabilities and apply that fix to our code.

Finally, once the code is fixed, we put our "Red Team" hat on again to find a way to bypass our newly implemented controls.  

This exercise forces you to look at the vulnerability from EVERY angle and I have personally seen it transform a researcher's approach to searching for XSS bugs.

I hope it helps!!

Discord - Discord: discord
Hire Me!  -  https://ars0nsecurity.com
Watch Live! - Twitch: rs0n_live
Free Tools! - https://github.com/R-s0n
Connect! - LinkedIn: harrison-richardson-cissp-oswe-msc-7a55bb158

• #education
• #bug_bounty
• #hackerone
• #bugcrowd
• #hacker
• #hacking