Case Studies of Award-Winning XSS Attacks: Part 1

Watch a step-by-step demo showing how an image file containing a script can be uploaded to a web app and used to launch a stored xss attack against another user.

Explore xss via http response splitting with a technical overview of reflected payloads in headers and escaping into the response body using carriage return newline tricks, then a step-by-step demo.

Demonstrates an XSS attack via HTTP response splitting using Burp Suite proxy, intercepting and replaying requests to reflect a language parameter and exploit header-to-body escaping.

Learn how XSS via cookie can be remotely exploitable by setting cookie domains to target subdomains, and how proof of remote exploitation affects bug bounty rewards.

Showcases how to perform xss via cookie by remotely setting a language cookie in the cookie jar and triggering alerts on a sensitive domain.

Discover how XSS via angularjs template injection works, using double curly brace payloads to detect injection points and tailor version-specific payloads for angularjs versions 1.6.0 and newer, with practical demos.

Demonstrates an xss attack via angularjs template injection in practice, showing how to check angular.version in the console and how to exploit it with a version-specific payload.

Examine cross site scripting vulnerabilities and how arbitrary scripting enables powerful exercises; explore image-based HTTP response splitting, cookie, and angular template injection attacks, with bug bounty rewards.