[gsf]

** - guide to Cross Site Scripting (XSS) testing for application security professionals**
————————————————-
## Intigriti 
🔗 [How to Test for XSS Part 1](<https://www.intigriti.com/researchers/hackademy/cross-site-scripting-xss/how-to-test-for-cross-site-scripting>)

## Learn a bit of HTML & JS

————————————————

## PortSwigger XSS

- 🔗 [PortSwigger XSS Labs](<https://portswigger.net/web-security/all-labs#cross-site-scripting>)
- 🔗 [PortSwigger XSS Blog Post](<https://portswigger.net/web-security/cross-site-scripting>)
- 🔗 [PortSwigger XSS CheatSheet](<https://portswigger.net/web-security/cross-site-scripting/cheat-sheet>) (Last Update Oct 24th 2025) Can Also use this with burp to find out what html tags, event handlers etc are accepted within a user input field.

———————————————-
## HTB Academy

- 🔗 [NOT FREE: HTB Academy XSS Module](<https://academy.hackthebox.com/course/preview/cross-site-scripting-xss>)
———————————————-

## OWASP XSS 

- 🔗 [OWASP XSS Filter Evasion Payloads](<https://cheatsheetseries.owasp.org/cheatsheets/XSS_Filter_Evasion_Cheat_Sheet.html>)
- 🔗 [Protecting Against XSS](<https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html>)

————————————————

## MITRE Info on XSS

- 🔗 [MITRE: Improper Neutralization of Input During Web Page Generation XSS](<https://cwe.mitre.org/data/definitions/79.html>)

————————————————

## NIST [NIST Vuln Guidelines]

(<https://www.nist.gov>)
(Mandatory guidelines for some Agencies and Organizations to follow **BUT** use this when referencing your findings it provides mitigations too)


learn at no-cost. today only
1 DevSecOps on AWS: Defend Against LLM Scrapers & Bot Traffic
https://www.udemy.com/course/aws-bot-def...DECEMBER03

2 DevSecOps: How to secure Web App with AWS WAF and CloudWatch
https://www.udemy.com/course/how-to-secu...DECEMBER03

3 devops & devsecops hands-on labs free to access
https://www.linkedin.com/posts/jose-prav...99169-Cq5I



# Learn HTML & JS

- [FreeCampCode](https://www.freecodecamp.org/)
- [CodeAcademy](https://www.codecademy.com/)
- [MDM Web Docs - JS Guide](https://developer.mozilla.org/en-US/docs/Web/JavaScript)

# Learn Web Security & XSS

Topics one must cover:
- Reflected XSS
- Stored XSS
- DOM-based XSS
- XSS bypass techniques
- Exploiting XSS to steal cookies, hijack sessions, etc.

Start here: [PortSwigger](https://portswigger.net/web-security)
Beginner to Expert level: [learning-path](https://portswigger.net/web-security/learning-paths) (Includes structured path)
All labs: [Practical-labs](https://portswigger.net/web-security/all-labs)

# Free practice challenges

- [HackThisSite](https://www.hackthissite.org/)

# Written tutorials

- [OWASP - XSS](https://owasp.org/www-community/attacks/xss)
- [hackertarget XSS](https://owasp.org/www-community/attacks/xss)