xss

13 minpostmessagexssclient-side

Intermediate level

With account

postMessage — common vulnerabilities: origin bypass, XSS sink, cross-window IDOR

How to identify and exploit vulnerabilities in window.postMessage(): listeners without origin validation, insecure JSON payloads that reach DOM XSS, cross-origin IDOR.

With account€1200

Stored XSS €1200 — sanitizer bypass via SVG href javascript: with entity encoding

Walkthrough of a real €1200 report: stored XSS in POE bypassing a sanitizer fix via SVG with href=`javascript:` and HTML entity encoding over the filtered characters.

12 minxssstored-xsssvg

13 minxsspayloadscontexts

XSS contexts — payloads per context (HTML, attribute, JS, URL, CSS)

How to identify the exact context where your input is injected and the payloads that escape each one: HTML body, HTML attribute, JS string, JS event, URL, CSS, JSON.

Stored XSS via SVG with href javascript: in chat — reclassification of Self-XSS

An SVG payload uploaded as an attachment. Filter bypassed. Rendered inline in the main context. Any chat participant is exposed on click.

11 minxssstored-xsssvg

Advanced level

13 mindom-xssxsspostmessage

DOM XSS — gadgets, postMessage handlers and CVE-2025-59840

DOM XSS isn't just innerHTML. Sources/sinks, gadget chains via toString(), postMessage handlers without origin checks, broken hash-based routing.

CSP bypass + CORS misconfig + XSS — a complete exploitation chain

How to chain CSP misconfiguration (unsafe-inline, wildcard sources, whitelisted JSONP endpoints), CORS with credentials and XSS for unrestricted data exfiltration.

17 mincspcorsxss

14 mindom-clobberingxsshtml-injection

DOM clobbering — overriding global JS variables to bypass sanitizers

How to use DOM clobbering (name/id collisions) to overwrite global JS variables and bypass sanitizers like DOMPurify, achieving XSS where innerHTML is blocked by default.

Premium$2500

Android XSS — exported Activity via ContentActivity (POE/Quora real report)

Walkthrough of Android XSS exploitable via an exported Activity intent in POE: how a filter-less ContentActivity leaks the WebView to attacker-controlled sites.

13 minandroidxssintent

15 minxsssecondary-contextdouble-parsing

Secondary context XSS — finding XSS where the primary parsing doesn't detect it

When the primary parsing escapes but a secondary context (markdown render, BBCode, a custom template engine) re-interprets, opening XSS hidden from traditional sanitizers.

XSS escalation — from Self-XSS to Account Takeover with real chains

How to turn a seemingly useless Self-XSS into a full takeover: clickjacking, login-CSRF + Self-XSS, cookie tossing, postMessage hijack, hash injection, OAuth flow abuse.

16 minxssatoescalation

16 minxsswaf-bypassencoding

XSS WAF bypass — encoding, parser differentials, case-only mutations

WAF bypass techniques for XSS: HTML entities, hex/decimal/unicode encoding, parser differentials (browser vs WAF), comment injection, case variations, JS template literals.

13 mincsp-bypassxssbrowser-security

CSP Bypass — JSONP, base-uri, AngularJS gadgets, dangling markup

Content-Security-Policy broken with strict-dynamic + JSONP, missing base-uri, AngularJS sandbox escapes, JSON hijacking. How to escalate XSS when the CSP theoretically blocks it.

14 minmutation-xssxssdompurify

With account

Mutation XSS — when the HTML changes between sanitizing and rendering

The sanitizer sees A but the browser renders B. SVG namespace tricks, badly-closed comments, MathML, the template element. How to find mXSS against DOMPurify and homemade sanitizers.

9 minxssreflected-xssgoogle-analytics

Reflected XSS on a 429 page via Google Analytics — the tracking snippet as vector

The Google Analytics snippet took part of the URL as unsanitized input. A string-literal breakout inside the script itself: the injection was already in JavaScript context.