⚔️
Pentest CodeX
CtrlK
LinkedInGithub
  • Home
    • External Link
  • Network Pentest
    • Recon
      • OSINT: Corporate Recon
        • Archives
        • Breaches
        • Business Investigation
        • Business Records
        • Cloud Storage
        • Compounded Networks
        • Contact Information
        • Domain Information
        • Domain Structure
        • Email Addresses
        • Intelligence
        • Internal Leaks
        • Introduction
        • Leaked Information
        • Locations
        • Open-Source Intelligence
        • Organization
        • OSINT Methodology
        • Public Domain Records
        • Services
        • Social Networks
        • Staff
        • Technologies in Use
        • Third Parties
    • Enumeration
      • Application Enumeration
      • Network Enumeration
      • Service Enumeration
        • Tools
        • Services
          • DNS 53
          • FTP 21
          • IMAP 143,993
          • IPMI 623
          • Kerberos 88
          • MSSQL 1433,1434,2433
          • MYSQL 3306
          • NFS 2049
          • Oracle TNS 1521
          • POP3 110,995
          • R-Services 512,513,514
          • R-Sync 873
          • RDP 3389
          • SMB 139,445
          • SMTP 25,465,587
          • SNMP 161,162,10161,10162
          • SSH 22
          • TFTP 69
          • WinRM 5985,5986
      • Web Enumeration
        • Accounts and sessions
          • Account creation
          • Account deletion
          • Logging in
          • Password change
          • Password reset
          • Security policies
        • Configuration
          • Default credentials
          • Denial of Service (DoS)
          • HTTP methods
          • HTTP request smuggling
          • HTTP response splitting
          • Identity and Access Management
          • Insecure Cookies
          • HTTP security headers
            • Clickjacking
            • CORS (Cross-Origin Resource Sharing)
            • CSP (Content Security Policy)
            • MIME type sniffing
        • Reconnaissance
          • Comments and metadata
          • Content Management System (CMS)
          • Directory fuzzing
          • Error messages
          • HTTP response headers
          • Known vulnerabilities
          • Other technologies
          • Site crawling
          • Subdomain & vhost fuzzing
          • Subdomains enumeration
          • Web Application Firewall (WAF)
        • User inputs
          • API
          • Arbitrary file download
          • Content-Type juggling
          • CRLF injection
          • CSRF (Cross-Site Request Forgery)
          • Directory traversal
          • HTTP parameter pollution
          • IDOR (Insecure Direct Object Reference)
          • Insecure deserialization
          • Insecure JSON Web Tokens
          • Null-byte injection
          • ORED Open redirect
          • SQL injection
          • SSRF (Server-Side Request Forgery)
          • SSTI (Server-Side Template Injection)
          • Unrestricted file upload
          • XSS (Cross-Site Scripting)
          • XXE injection
          • File inclusion
            • LFI to RCE
            • RFI to RCE
    • Exploitation
      • Application Exploitation
      • Binary Explotation
      • Service Exlpoitation
        • Tools
        • Services
          • DNS 53
          • FTP 21
          • IMAP 143,993
          • IPMI 623
          • Kerberos 88
          • MSSQL 1433,1434,2433
          • MYSQL 3306
          • NFS 2049
          • Oracle TNS 1521
          • POP3 110,995
          • R-Services 512,513,514
          • R-Sync 873
          • RDP 3389
          • SMB 139,445
          • SMTP 25,465,587
          • SNMP 161,162,10161,10162
          • SSH 22
          • TFTP 69
          • WinRM 5985,5986
      • Web Exploitation
        • Accounts and sessions
          • Account creation
          • Account deletion
          • Logging in
          • Password change
          • Password reset
          • Security policies
        • Configuration
          • Default credentials
          • Denial of Service (DoS)
          • HTTP methods
          • HTTP request smuggling
          • HTTP response splitting
          • Identity and Access Management
          • Insecure Cookies
          • HTTP security headers
            • Clickjacking
            • CORS (Cross-Origin Resource Sharing)
            • CSP (Content Security Policy)
            • MIME type sniffing
        • Reconnaissance
          • Comments and metadata
          • Content Management System (CMS)
          • Directory fuzzing
          • Error messages
          • HTTP response headers
          • Known vulnerabilities
          • Other technologies
          • Site crawling
          • Subdomain & vhost fuzzing
          • Subdomains enumeration
          • Web Application Firewall (WAF)
        • User inputs
          • API
          • Arbitrary file download
          • Content-Type juggling
          • CRLF injection
          • CSRF (Cross-Site Request Forgery)
          • Directory traversal
          • HTTP parameter pollution
          • IDOR (Insecure Direct Object Reference)
          • Insecure deserialization
          • Insecure JSON Web Tokens
          • Null-byte injection
          • ORED Open redirect
          • SQL injection
          • SSRF (Server-Side Request Forgery)
          • SSTI (Server-Side Template Injection)
          • Unrestricted file upload
          • XSS (Cross-Site Scripting)
          • XXE injection
          • File inclusion
            • LFI to RCE
            • RFI to RCE
    • Pre Exploitation
      • Shell
      • Tools
    • Post-Exploitation
      • File Transfer
      • Fully Interative Shell
      • Linux Post Exploitation
      • Windows Post Exploitation
      • Pivoting, Tunneling, and Port Forwarding
        • Port Forwarding
          • Linux
          • Windows
        • Poviting
          • Linux
          • Windows
        • Tunneling
          • Linux
          • Windows
    • Privilege Escalation
      • Linux Privileage Escalation
        • Enumeration
        • Environment Enumeration
        • Exploiting LXD for Privilege Escalation
        • Exploiting Misconfigured Binaries
        • Exploiting Misconfigured Services
        • Exploiting Network Shares
        • Exploiting SUID and SGID Binaries
        • Finding Writable Files and Directories
        • Linux Services & Internals Enumeration
        • Miscellaneous Exploits
        • Services
      • Tools & Techniques
        • Windows Tools
      • Windows Privilege Escalation
        • Credential Dumping & Enumeration
        • Credential Theft
        • Handy Commands
        • Initial Enumeration
        • Other Commands
        • Searching for Passwords in Files
        • Wireless Network Credential Extraction
    • Active Directory Attack
      • Enumeration
        • Initial Enumeration
        • BloodHound
        • LDAP
        • PowerView
        • CrackMapExec
        • ACL Enumeration & Tactics
        • Credentialed Enumeration
        • Enumeration by Living Off the Land
        • Enumerating Security Controls
        • Tools & Techniques
          • Writers and Blogs To Follow
      • Attack Techniques
        • LLMNR/NTB-NS Poisoning
        • ASREPRoasting
        • DCSync
        • Kerberoasting
        • NoPac
        • Transfering Files
        • Password Spraying & Password Policies
        • PetitPotam
        • PrintNightmare
        • Privileged Access
        • Group Policy Enumeration & Attacks
        • Trust Relationships - Child > Parent Trusts
        • Trust Relationships - Cross-Forest
        • Miscellaneous Misconfigurations
        • Tools
      • Advanced Exploitation Techniques
        • Active Directory Trust Attacks
        • ADCS Attacks
        • DACL Attacks
        • Intro to C2 Operations with Sliver
        • Introduction to Windows Evasion Techniques
        • Kerberos Attacks
        • MSSQL, Exchange, and SCCM Attacks
        • NTLM Relay Attacks
        • Exploiting Active Directory (THM)
          • Exploiting AD Users
          • Exploiting Certificates
          • Exploiting Domain Trusts
          • Exploiting Kerberos Delegation
          • Exploiting Permission Delegation
        • Persisting Active Directory (THM)
          • Computer Accounts
          • Directory Service Restore Mode (DSRM)
          • Malicious Security Support Provider (SSP)
          • Persistence through ACLs
          • Persistence through Certificates
          • Persistence through Credentials
          • Persistence through GPOs
          • Persistence through Group Membership
          • Persistence through SID History
          • Persistence through Tickets
          • Skeleton keys
      • Lateral Movement
        • Windows Lateral Movement
  • Courses
    • HTB-CPTS
      • enumeration
        • Enum Cheklist
        • Initial Enumeration
      • Nmap
        • Nmap Full Flag
        • Protocol Scan
        • scan-network-with-nmap
      • Attacking Common Applications
        • 1.Content Management Systems (CMS)
          • 1.-wordpress-discovery-and-enumeration
          • 2.-attacking-wordpress
          • 3.-joomla-discovery-and-enumeration
          • 4.-attacking-joomla
          • 5.-drupal-discovery-and-enumeration
          • 6.-attacking-drupal
        • 2. Servlet Containers and Software Development
          • 10.-attacking-jenkins
          • 7.-tomcat-discovery-and-enumeration
          • 8.-attacking-tomcat
          • Attacking Jenkins - Focused Commands & Key Points
        • 3. Infrastructure and Network Monitoring Tools
          • 11.-splunk-discovery-and-enumeration
          • 12.-attacking-splunk
          • 13.prtg-network-monitor
        • 4. Customer Service Mgmt & Configuration Management
          • 14.-osticket
          • 15.gitlab-discovery-and-enumeration
          • 16.-attacking-gitlab
        • 5. Common Gateway Interfaces
          • 17.-attacking-tomcat-cgi
          • 18.-attacking-cgi-applications-shellshock
        • 6. Thick Client Applications
          • 19.-attacking-thick-client-applications
          • 20.exploiting-web-vulnerabilities-in-thick-client-applications
        • 7. Miscellaneous Applications
          • 21.-coldfusion-discovery-and-enumeration
          • ColdFusion Exploitation Guide
          • 23.-iis-tilde-enumeration
          • 24.attacking-ldap
          • 25.-web-mass-assignment-vulnerabilities
          • 26.attacking-applications-connecting-to-services
          • 27.other-notable-applications
        • 8. Closing Out
          • 28.application-hardening
      • Attacking Common Services
        • 1.protocol-specific-attacks
        • 2.ftp
        • 3.smb
        • 4.sql-databases
        • 5.rdp
        • 6.dns
        • 7.smtp
      • Active Directory Enumeration & Attacks
        • 0. AD Pentest
          • Quick Guide To AD Pentesting
          • Active Directory: Full Attack Name
          • Active Directory Advanced Concepts
          • Active Directory Delegation
          • Beyond-Active-Directory
        • 1.Initial Enumeration
          • 1.External Recon and Enumeration Principles
          • 1.initial-enumeration-of-the-domain
          • Active-Directory-Basic-Command
        • 2.Sniffing out a Foothold
          • 3. LLMNR-NBT-NS Poisoning - from Linux
          • 4.LLMNR-NBT-NS Poisoning - from Windows
        • 3.Sighting In, Hunting For A User
          • 5.Password Spraying Overview
          • 6.Enumerating & Retrieving Password Policies
          • 7.Password Spraying - Making a Target User List
        • 4.Spray Responsibly
          • 8. Internal Password Spraying - from Linux
          • 9.Internal Password Spraying - from Windows
        • 5.Deeper Down the Rabbit Hole
          • 10. Enumerating Security Controls
          • 11. Credentialed Enumeration - from Linux
          • 12.Credentialed Enumeration - from Windows
          • 13. Living Off the Land
        • 6.Cooking with Fire
          • 14.Kerberoasting - from Linux
          • 15. Kerberoasting - from Windows
          • Kerberoasting Attack Step by Step Guide
          • Kerberoasting Attack Step by Step Guide
        • 7.An ACE in the Hole
          • 16.Access Control List (ACL) Abuse Primer
          • 17. ACL Enumeration
          • 18. ACL Abuse Tactics
          • 19. DCSync
        • 8.Stacking The Deck
          • 20.Privileged Access
          • 21.Kerberos Double Hop Problem
          • 22.Bleeding Edge Vulnerabilities
          • 23.Miscellaneous Misconfigurations
        • 9.Why So Trusting
          • 24.Domain Trusts Primer
          • 25.Attacking Domain Trusts - Child - Parent Trusts - from Windows
          • 26. Attacking Domain Trusts - Child - Parent Trusts - from Linux
        • 10.Breaking Down Boundaries
          • 27.Attacking Domain Trusts - Cross-Forest Trust Abuse - from Windows
          • 28.Attacking Domain Trusts - Cross-Forest Trust Abuse - from Linux
        • 11.Defensive Considerations
          • 29.hardening-active-directory
          • 30.Additional AD Auditing Techniques
      • Linux Privilege Escalation
        • linux-hardening
        • linux-priv-esc-to-quick-check-the-system
        • 1.Information Gathering
          • 1.environment-enumeration
          • 2.linux-services-and-internals-enumeration
          • 3.credential-hunting
        • 2.Environment-based Privilege Escalation
          • 4.path-abuse
          • 5.wildcard-abuse
          • 6.escaping-restricted-shells
        • 3.Permissions-based Privilege Escalation
          • 10.capabilities
          • 7.-special-permissions
          • 8.sudo-rights-abuse
          • 9.privileged-groups
        • 4.Service-based Privilege Escalation
          • 11.vulnerable-services
          • 12.cron-job-abuse
          • LXC Privilege Escalation Techniques
          • 14.-docker
          • 15.kubernetes
          • 16.logrotate
          • 17.miscellaneous-techniques
        • 5.Linux Internals-based Privilege Escalation
          • 18.kernel-exploits
          • 19.shared-libraries
          • 20.-shared-object-hijacking
          • 21.python-library-hijacking
        • 6.Recent 0-Days
          • 22.sudo
          • 23.polkit
          • 24.dirty-pipe
          • 25.netfilter
      • Windows Privilege Escalation
        • priv-esc
        • 1.Getting the Lay of the Land
          • 1.situational-awareness
          • 2.initial-enumeration
          • 3.communication-with-processes
        • 2.Windows User Privileges
          • 4.windows-privileges-overview
          • 5.seimpersonate-and-seassignprimarytoken
          • 6.-sedebugprivilege
          • Exploiting SeTakeOwnershipPrivilege
        • 3.Windows Group Privileges
          • 10.dnsadmins
          • 11.-hyper-v-administrators
          • Key Concepts:
          • Key Concepts:
          • 8.-windows-built-in-groups
          • Exploiting Event Log Readers Group for Security Log Access
        • 4.Attacking the OS
          • 14.user-account-control
          • 15.weak-permissions
          • 16.kernel-exploits
          • 17.vulnerable-services
          • 18.dll-injection
        • 5.Credential Theft
          • 19.credential-hunting
          • 20.-other-files
          • 21.further-credential-theft
        • 6.Restricted Environments
          • 22.-citrix-breakout
        • 7.Additional Techniques
          • 23.-interacting-with-users
          • 24.pillaging
          • 25.miscellaneous-techniques
        • 8.Dealing with End of Life Systems
          • Key Points:
          • 27.windows-server
          • 28.windows-desktop-versions
      • Server-side Attacks
        • server-side-vulnerabilities
      • Web Attacks
        • 1.-http-verb-tampering
        • 2.-insecure-direct-object-references-idor
        • 3.-xml-external-entity-xxe-injection
        • web-attacks-to-the-point
      • Web Service & API Attacks
        • web-service-and-api-attacks
      • command-injections
      • sql-injection
      • xss
        • XSS-based Session Hijacking
      • Broken Authentication
      • login-brute-forcing
      • password-attacks
      • password-cracking
      • Session Security Guide
      • file-transfer
      • file-upload-attacks
      • Shells and payloads
      • upgrading-tty-shell
      • using-the-metasploit-framework
      • File Inclusion
        • 1.File Disclosure
          • 1.local-file-inclusion-lfi
          • 2.-basic-bypasses
          • 3.-php-filters
        • 2.Remote Code Execution
          • 4.-php-wrappers
          • 5.-remote-file-inclusion-rfi
          • 6.-lfi-and-file-uploads
          • 7.-log-poisoning
        • 3.Automation and Prevention
          • 8.-automated-scanning
          • 9.-file-inclusion-prevention
      • ligolo-ng
      • pivoting-tunneling-and-port-forwarding
      • cpts-tips
    • CBBH
      • Attacking Web Applications with Ffuf
      • Broken Authentication
      • Bug Bounty Hunting Process
      • Command Injections
      • Cross-Site Scripting (XSS)
      • File Inclusion
      • File Upload Attacks
      • Hacking WordPress
      • Information Gathering - Web Edition
      • Introduction to Web Applications
      • JavaScript Deobfuscation
      • Login Brute Forcing
      • Server-side Attacks
      • Session Security
      • SQL Injection Fundamentals
      • SQLMap Essentials
      • Using Web Proxies
      • Web Attacks
      • Web Requests
      • Web Service & API Attacks
    • CWEE
      • Abusing HTTP Misconfigurations
      • Advanced Deserialization Attacks
      • Advanced SQL Injections
      • Advanced XSS and CSRF Exploitation
      • Attacking Authentication Mechanisms
      • Blind SQL Injection
      • HTTP Attacks
      • HTTPs/TLS Attacks
      • Injection Attacks
      • Intro to Whitebox Pentesting
      • Introduction to Deserialization Attacks
      • Introduction to NoSQL Injection
      • Modern Web Exploitation Techniques
      • Parameter Logic Bugs
      • Whitebox Attacks
    • OSCP
      • Buffer Overflow
      • Cross Compilation
      • Enumeration
      • Exam Day
      • Exam Info
      • File Transfer Techniques
      • Initial Foothold
      • Password Cracking
      • Pivoting and Tunneling
      • Post Exploitation
      • Post Initlal Foothold
      • Practice Labs
      • Reporting
      • Scanning
      • Tools Quick Use
      • Web Attacks
      • Wordpress
Powered by GitBook
On this page
Edit
  1. Network Pentest
  2. Exploitation
  3. Web Exploitation
  4. User inputs

XSS (Cross-Site Scripting)

PreviousUnrestricted file uploadNextXXE injection

Last updated 5 months ago