XSS Named

Cross-site scripting literacy on $PROGRAM in-scope assets — hunter mindset and defender notes, not stranger exploit cookbooks.

15 min+39 XP3 quiz

Module progress1 of 5

Visual · t20_xss_named

XSS = untrusted input reaches browser execution context. $PROGRAM scope only. Original Cyberlium.

Opening

Learn what reflected, stored, and DOM XSS mean so you can report and defend — not spray payloads on sites you never joined.

Cross-site scripting (XSS) occurs when attacker-controlled input is reflected or stored and executed in a victim's browser context — enabling session abuse, UI manipulation, or chained impact depending on app design. Hunters think in contexts: HTML body, attribute, JavaScript string, URL — and whether CSP, encoding, or framework defaults block execution. Cyberlium teaches XSS categories (reflected, stored, DOM), CWE-79 literacy, and defender controls (output encoding, CSP, HttpOnly cookies) on assets listed in YOUR enrolled $PROGRAM scope or intentional $LAB_BOUNTY — not kitchen-sink payload lists for random SaaS, not mass scanning out-of-scope subdomains, no phishing templates, no stealing real user sessions from strangers. Validation = minimal proof on in-scope / lab; one alert or harmless DOM marker beats dumping victim cookies.

1. XSS categories (literacy)

Reflected: input echoed in response. Stored: input persisted and served to others. DOM: client-side sink without server round-trip — name the category in reports.

Hunter question: where does untrusted data enter, and which sink executes it? Map from YOUR asset inventory — not blind payload fuzz on every parameter.

Command guide

Try these commands — XSS categories (literacy)

═══ LINUX / macOS (Web & API Security Testing) ═══

Test HTTP methods on authorized lab endpoint

Command — copy this

for method in GET POST PUT DELETE OPTIONS; do
  curl -s -o /dev/null -w "%-8s -> Status: %{http_code}
" -X $method "http://${LAB_HOST:-127.0.0.1}/api/v1/user"
done

Test JSON API with Authorization Bearer header

Command — copy this

curl -s -X POST "http://${LAB_HOST:-127.0.0.1}/api/v1/profile" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <TEST_TOKEN>" \
  -d '{"id": 1, "action": "view"}' | jq . 2>/dev/null || cat

Check for CORS misconfiguration headers

Command — copy this

curl -s -I -H "Origin: https://attacker.com" "http://${LAB_HOST:-127.0.0.1}/api/v1/status" | grep -i "Access-Control"

Primary tools to practice this lesson: curl, jq. Reference sites: XSS literacy; OWASP XSS (https://owasp.org/www-community/attacks/xss/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Defender controls

Context-aware output encoding, Content-Security-Policy, HttpOnly/Secure cookies, framework auto-escaping, sanitize only as last resort with allowlists.

Monitor for anomalous script injection in logs; treat XSS as impact-dependent — session on sensitive app vs static marketing page.

3. Scope boundary

Test XSS hypotheses only on $PROGRAM in-scope hosts you enrolled or $LAB_BOUNTY per brief — read program rules on self-XSS and automation.

No XSS PoCs on out-of-scope assets, no mass parameter spraying, no social-engineering victims to click your link on production strangers.

4. What you ship: XSS literacy card

Three XSS types + hunter sink/source question + two defender controls + $PROGRAM-only sentence.

5. What you record before the next lesson

XSS literacy card path.

6. Wrong vs right: random sites vs in-scope program

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong
Run XSS payload lists against every URL on the internet 'for practice.'
Right
Name XSS types and defenses on enrolled scope. Next: IDOR Named.

Mission: XSS literacy card

1) Define reflected, stored, DOM in one line each. 2) Write hunter source→sink question. 3) Name two defender controls. 4) Write NEVER on unenrolled sites.

Stuck? Ask Cyberlium AI Mentor

Ask Mentor: “Self-XSS — when is it reportable on $PROGRAM?”

Knowledge Check

APPLY: XSS on Cyberlium means:

Multiple choice

Knowledge Check

APPLY: True or False: Mass XSS fuzzing on unenrolled sites is bounty practice.

True or False

Knowledge Check

APPLY: Defenders reduce XSS with:

Multiple choice

← Previous

Answer all 3 knowledge checks to continue. (0/3 answered)

Guest mode — log in to track XP