Bypassing XSS Defenses Part 1: Finding Allowed Tags and Attributes

This post intends to serve as a guide for a common bypass technique when you're up against a web application firewall (WAF). In the event that the WAF limits what tags and attributes are allowed to be passed, we can use BurpSuite's Intruder functionality to learn which tags are allowed. Table of Contents: Setting the…

XSS and CORS Bypass in - HADESS

XSS Web Security Lens

XSS - Attacks & Defense

CSP and Bypasses

Bypassing XSS Defenses Part 1: Finding Allowed Tags and Attributes

Full article: Case Study: Extenuation of XSS Attacks through Various Detecting and Defending Techniques

Defending against XSS with CSP

Preventing XSS in Angular

XSS: Beating HTML Sanitizing Filters - PortSwigger

ZTWeb: Cross site scripting detection based on zero trust - ScienceDirect