Bypassing XSS Defenses Part 1: Finding Allowed Tags and Attributes

This post intends to serve as a guide for a common bypass technique when you're up against a web application firewall (WAF). In the event that the WAF limits what tags and attributes are allowed to be passed, we can use BurpSuite's Intruder functionality to learn which tags are allowed. Table of Contents: Setting the…

5 methods for Bypassing XSS Detection in WAFs

Applied Sciences, Free Full-Text

How to Find XSS Vulnerability: A Step-by-Step Guide & Tools

Bypassing modern XSS mitigations with code-reuse attacks - Truesec

Defending against XSS with CSP

Bypassing XSS Defenses Part 1: Finding Allowed Tags and Attributes

How to Fix XSS Vulnerabilities on Web App Links - BreachLock

Content Security Bypass Techniques to perform XSS

Bypassing Signature-Based XSS Filters: Modifying HTML - PortSwigger

Preventing XSS in Angular