--- title: "#xss articles | Hashnode" description: "Explore 175 articles tagged #xss on Hashnode. Tutorials, guides, and how-tos from the community." url: "https://hashnode.com/tag/xss" --- Tag # #xss 175 posts · 24 followers [Milan Nikic](https://hashnode.com/@nick79) · [1d ago](https://hashnode.com/posts/cross-site-scripting-xss-in-java-and-react-reflected-and-stored-xss-part-1/6af30aeb5f0f17eb1bf10a48) ### [Cross-Site Scripting (XSS) in Java and React: Reflected and Stored XSS (Part 1)](https://securitydepth.hashnode.dev/cross-site-scripting-xss-in-java-and-react-reflected-and-stored-xss-part-1?utm_source=hashnode&utm_medium=feed) Prevent reflected and stored XSS in Java and React with practical examples of output encoding, safe rendering, and HTML sanitization. 20 min read · [securitydepth.hashnode.dev](https://securitydepth.hashnode.dev/cross-site-scripting-xss-in-java-and-react-reflected-and-stored-xss-part-1?utm_source=hashnode&utm_medium=feed) [Ciphemic academia](https://hashnode.com/@ciphemicacademia) · [Oct 13](https://hashnode.com/posts/sql-injection-vs-xss-vs-csrf-1-million-users-in-20-hours-and-a-400-000-fine/6acd8dff748cb8132c432949) ### [SQL Injection vs. XSS vs. CSRF: 1 Million Users in 20 Hours and a £400,000 Fine](https://ciphemicacademia.hashnode.dev/sql-injection-vs-xss-vs-csrf-1-million-users-in-20-hours-and-a-400-000-fine?utm_source=hashnode&utm_medium=feed) A worm hit 1 million users in 20 hours. A breach drew a record fine. Three web attacks, and who each one fools. 15 min read · [ciphemicacademia.hashnode.dev](https://ciphemicacademia.hashnode.dev/sql-injection-vs-xss-vs-csrf-1-million-users-in-20-hours-and-a-400-000-fine?utm_source=hashnode&utm_medium=feed) [Dimakatso Sebatane](https://hashnode.com/@ovawatch-security) · [Oct 3](https://hashnode.com/posts/case-study-from-html-injection-to-credential-theft/6ad5f939ac782aad2c7b8a5d) ### [Case Study: From HTML Injection to Credential Theft](https://ovawatch-security.hashnode.dev/case-study-from-html-injection-to-credential-theft?utm_source=hashnode&utm_medium=feed) Examining how insufficient HTML sanitization enables credential phishing through attacker-controlled content Full video at https://youtu.be/XDD-hwdWJjY 11 min read · [ovawatch-security.hashnode.dev](https://ovawatch-security.hashnode.dev/case-study-from-html-injection-to-credential-theft?utm_source=hashnode&utm_medium=feed) [Jayesh Sojitra](https://hashnode.com/@jayeshsojitra) · [Sep 19](https://hashnode.com/posts/5-frontend-security-mistakes-that-are-easy-to-miss/6aae67263497e8626fc9c568) ### [5 Frontend Security Mistakes That Are Easy to Miss](https://jayesh-sojitra.hashnode.dev/5-frontend-security-mistakes-that-are-easy-to-miss?utm_source=hashnode&utm_medium=feed) Security gets treated as a backend problem until a frontend mistake ships one of these five — all common, all easy to miss in a normal code review. 4 min read · [jayesh-sojitra.hashnode.dev](https://jayesh-sojitra.hashnode.dev/5-frontend-security-mistakes-that-are-easy-to-miss?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Sep 1](https://hashnode.com/posts/webversepro-snowedout-writeup/6a96cbdf9d4951f2dcb9645a) ### [WebVersePro : SnowedOut writeup](https://exploitnotes.hashnode.dev/webversepro-snowedout-writeup?utm_source=hashnode&utm_medium=feed) SnowedOut on WebVerseLabs Pro: exploit Pinehollow Plow Tracker with JavaScript injection and forged CSP reports to retrieve the flag. 6 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/webversepro-snowedout-writeup?utm_source=hashnode&utm_medium=feed) [Abdul Rehman](https://hashnode.com/@rehman0) · [Aug 29](https://hashnode.com/posts/bad-reception-intigriti-august-2026-ctf-writeup/6a924a918d1bb55ef2ea61b4) ### [Bad Reception — Intigriti August 2026 CTF Writeup](https://skin-security.hashnode.dev/bad-reception-intigriti-august-2026-ctf-writeup?utm_source=hashnode&utm_medium=feed) Chaining an unsanitized JSONP endpoint with a stored XSS sink to hijack an admin bot and unlock hidden TV channels. 5 min read · [skin-security.hashnode.dev](https://skin-security.hashnode.dev/bad-reception-intigriti-august-2026-ctf-writeup?utm_source=hashnode&utm_medium=feed) [Victor Wariboko-West](https://hashnode.com/@victorwest) · [Aug 22](https://hashnode.com/posts/cross-site-scripting-xss-the-vulnerability-that-refuses-to-die/6a88fe7c33a824befa7a1f4a) ### [Cross-Site Scripting (XSS): The Vulnerability That Refuses to Die](https://cybersage.hashnode.dev/cross-site-scripting-xss-the-vulnerability-that-refuses-to-die?utm_source=hashnode&utm_medium=feed) Learn how stored, reflected, and DOM-based XSS attacks work, with real code examples showing vulnerable patterns and their fixes 5 min read · [cybersage.hashnode.dev](https://cybersage.hashnode.dev/cross-site-scripting-xss-the-vulnerability-that-refuses-to-die?utm_source=hashnode&utm_medium=feed) [Vũ Nhật Lâm](https://hashnode.com/@kami61) · [Aug 20](https://hashnode.com/posts/bdthemes-wordpress-supply-chain-poisoned-json-en/6a86c6975a950cf3d221d002) ### [BdThemes: A WordPress Supply Chain Attack That Changed No Code At All](https://blog.fiscybersec.com/bdthemes-wordpress-supply-chain-poisoned-json-en?utm_source=hashnode&utm_medium=feed) Summary Not a single source code file in the WordPress.org repository was modified. No plugin update was released. No file on disk changed. Yet rogue administrator accounts were created on victim site 17 min read · [blog.fiscybersec.com](https://blog.fiscybersec.com/bdthemes-wordpress-supply-chain-poisoned-json-en?utm_source=hashnode&utm_medium=feed) [M1H](https://hashnode.com/@m1h) · [Aug 16](https://hashnode.com/posts/breached-credentials-lead-to-admin-account-compromise-via-stored-xss/6a81e79ba4fc0cf163fda2d1) ### [Breached Credentials Lead to Admin Account Compromise via stored XSS](https://m1h.hashnode.dev/breached-credentials-lead-to-admin-account-compromise-via-stored-xss?utm_source=hashnode&utm_medium=feed) Web application pentesting starts by obtaining credentials through OSINT, leads to gaining initial access, followed by an XSS attack to become admin. 5 min read · [m1h.hashnode.dev](https://m1h.hashnode.dev/breached-credentials-lead-to-admin-account-compromise-via-stored-xss?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Aug 10](https://hashnode.com/posts/tryhackme-whyhackme-writeup/6a79b6bdb6f0f00fce179f0d) ### [TryHackMe : WhyHackMe writeup](https://exploitnotes.hashnode.dev/tryhackme-whyhackme-writeup?utm_source=hashnode&utm_medium=feed) Full Hack The Box WhyHackMe walkthrough covering blind stored XSS, localhost credential theft, SSH, iptables, PCAP analysis, CGI RCE, and root access. 15 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/tryhackme-whyhackme-writeup?utm_source=hashnode&utm_medium=feed)