--- title: "#xss-attacks articles | Hashnode" description: "Explore 39 articles tagged #xss-attacks on Hashnode. Tutorials, guides, and how-tos from the community." url: "https://hashnode.com/tag/xss-attacks" --- Tag # #xss-attacks 39 posts · 3 followers [Alejandro Baño](https://hashnode.com/@alexb616) · [Aug 7](https://hashnode.com/posts/one-click-no-file-upload-xss-without-the-upload/6a75a5b1bea5e9f028fd66e3) ### [One Click, No File: Upload XSS Without the Upload](https://blog.cain.tech/one-click-no-file-upload-xss-without-the-upload?utm_source=hashnode&utm_medium=feed) How multipart/form-data turns "the victim has to pick a file" into a single link 13 min read · [blog.cain.tech](https://blog.cain.tech/one-click-no-file-upload-xss-without-the-upload?utm_source=hashnode&utm_medium=feed) [Sreeram K S](https://hashnode.com/@sreeram-ks) · [Jun 20](https://hashnode.com/posts/what-is-xss-cross-site-scripting/6a365a8b83a40a289b43236e) ### [What is XSS (Cross-Site Scripting)?](https://code-as-a-story.hashnode.dev/what-is-xss-cross-site-scripting?utm_source=hashnode&utm_medium=feed) How a website accidentally runs someone else’s code 6 min read · [code-as-a-story.hashnode.dev](https://code-as-a-story.hashnode.dev/what-is-xss-cross-site-scripting?utm_source=hashnode&utm_medium=feed) [Emma Engström](https://hashnode.com/@hexemma) · [Mar 29](https://hashnode.com/posts/dom-based-xss/69c8d7f37816e434a005d764) ### [DOM-Based XSS in DVWA](https://pentesting-dvwa.hashnode.dev/dom-based-xss?utm_source=hashnode&utm_medium=feed) Introduction This post examines a DOM-based cross-site scripting (XSS) vulnerability in the Damn Vulnerable Web Application (DVWA) and demonstrates how it can be exploited to achieve client-side code 14 min read · [pentesting-dvwa.hashnode.dev](https://pentesting-dvwa.hashnode.dev/dom-based-xss?utm_source=hashnode&utm_medium=feed) [Emma Engström](https://hashnode.com/@hexemma) · [Mar 25](https://hashnode.com/posts/stored-xss/69c4020710e664c5dab8e380) ### [Stored XSS in DVWA](https://pentesting-dvwa.hashnode.dev/stored-xss?utm_source=hashnode&utm_medium=feed) Introduction This post examines a Stored Cross-Site Scripting (XSS) vulnerability in the Damn Vulnerable Web Application (DVWA), and demonstrates how it can be used to achieve persistent client-side c 12 min read · [pentesting-dvwa.hashnode.dev](https://pentesting-dvwa.hashnode.dev/stored-xss?utm_source=hashnode&utm_medium=feed) [Emma Engström](https://hashnode.com/@hexemma) · [Mar 19](https://hashnode.com/posts/reflected-xss/69bbe3fd8c55d6eefbde4dc0) ### [Reflected XSS in DVWA](https://pentesting-dvwa.hashnode.dev/reflected-xss?utm_source=hashnode&utm_medium=feed) Introduction This post demonstrates how a reflected Cross-Site Scripting (XSS) vulnerability in the Damn Vulnerable Web Application (DVWA) can be exploited to execute malicious client-side scripts in 14 min read · [pentesting-dvwa.hashnode.dev](https://pentesting-dvwa.hashnode.dev/reflected-xss?utm_source=hashnode&utm_medium=feed) [Shaishab Chandra Shil](https://hashnode.com/@shaishab316) · [Mar 15](https://hashnode.com/posts/csrf-token-to-protect-cookies/69b6c41cf4eb2f8b0493489f) ### [CSRF token to protect cookies](https://shaishab316.hashnode.dev/csrf-token-to-protect-cookies?utm_source=hashnode&utm_medium=feed) The Shield Your Cookies 4 min read · [shaishab316.hashnode.dev](https://shaishab316.hashnode.dev/csrf-token-to-protect-cookies?utm_source=hashnode&utm_medium=feed) [Wiktoria Blomgren Strandberg](https://hashnode.com/@wikipedia01) · [Mar 14](https://hashnode.com/posts/csp-bypass/69b59165210c74252f0bad5d) ### [CSP Bypass in DVWA](https://pentesting-dvwa.hashnode.dev/csp-bypass?utm_source=hashnode&utm_medium=feed) Documented penetration test of CSP Bypass vulnerability in DVWA. 16 min read · [pentesting-dvwa.hashnode.dev](https://pentesting-dvwa.hashnode.dev/csp-bypass?utm_source=hashnode&utm_medium=feed) [Frank Kelechi Oge](https://hashnode.com/@frankdotdev) · [Feb 15](https://hashnode.com/posts/the-two-bugs-that-kill-startups-a-deep-dive-into-xss-and-csrf/699235fac4084498afcb5d18) ### [The Two Bugs That Kill Startups: A Deep Dive into XSS and CSRF](https://frankoge.com/blog/the-two-bugs-that-kill-startups-a-deep-dive-into-xss-and-csrf?utm_source=hashnode&utm_medium=feed) You can have the cleanest React code, the fastest API, and the most beautiful UI. But if I can inject a script into your search bar that steals your users' session cookies, your startup is dead. ​Security is not an "add-on." It is a fundamental requi... 2 min read · [frankoge.com](https://frankoge.com/blog/the-two-bugs-that-kill-startups-a-deep-dive-into-xss-and-csrf?utm_source=hashnode&utm_medium=feed) [Ashifur Rahaman](https://hashnode.com/@ashif-arsb) · [Jan 26](https://hashnode.com/posts/aspnet-core-cross-site-scripting-xss/697757fe02f58558d3b7988b) ### [ASP.NET Core: Cross-Site Scripting (XSS)](https://aspnetcore.hashnode.dev/aspnet-core-cross-site-scripting-xss?utm_source=hashnode&utm_medium=feed) Cross-Site Scripting (XSS) is a security vulnerability that allows an attacker to inject malicious client-side scripts (usually JavaScript) into web pages viewed by other users. Unlike CSRF (which targets the server by tricking it into accepting a re... 4 min read · [aspnetcore.hashnode.dev](https://aspnetcore.hashnode.dev/aspnet-core-cross-site-scripting-xss?utm_source=hashnode&utm_medium=feed) [Cristhian Cano Bogado](https://hashnode.com/@paraguayandev) · [Jan 15](https://hashnode.com/posts/apexescape-proteges-tus-aplicaciones-oracle-apex-contra-xss/6969171ebbb40a38abfc8411) ### [APEX\_ESCAPE: ¿Proteges tus aplicaciones Oracle APEX contra XSS?](https://paraguayandev.hashnode.dev/apexescape-proteges-tus-aplicaciones-oracle-apex-contra-xss?utm_source=hashnode&utm_medium=feed) Cuando desarrollamos aplicaciones en Oracle APEX, solemos concentrarnos en la lógica del negocio, la experiencia de usuario y el rendimiento. Sin embargo, hay un aspecto crítico que muchas veces se pasa por alto hasta que es demasiado tarde: la segur... 4 min read · [paraguayandev.hashnode.dev](https://paraguayandev.hashnode.dev/apexescape-proteges-tus-aplicaciones-oracle-apex-contra-xss?utm_source=hashnode&utm_medium=feed)