Exploiting Cross-site Scripting to steal Cookies – PortSwigger Write Up
Learn how to exploit stored XSS vulnerabilities to steal session cookies and perform Session Hijacking in this PortSwigger lab.
May 5, 2022 Juan Antonio González Mena
All Posts
130 articles
Stored DOM XSS – PortSwigger Write Up
Learn how to exploit stored DOM XSS vulnerabilities in the comments functionality and how to bypass JavaScript's replace() method.
May 4, 2022 Juan Antonio González Mena
Reflected DOM XSS – PortSwigger Write Up
Learn how to exploit a Reflected DOM XSS vulnerability in PortSwigger Lab. Step-by-step guide to identify and exploit an insecure script that processes reflected data in the DOM in a vulnerable way.
May 3, 2022 Juan Antonio González Mena
Rogue AP using hostapd-wpe - Attacks on WPA Enterprise Networks
Learn how to perform Rogue AP attacks against WPA Enterprise networks using hostapd-wpe to capture user credentials.
May 2, 2022 Eric Labrador
DOM XSS in AngularJS expression with angle brackets and double quotes HTML-encoded – PortSwigger Write Up
Learn how to exploit a DOM XSS in AngularJS expressions in PortSwigger Lab. Step-by-step guide to execute JavaScript through Angular expressions when angle brackets and double quotes are HTML-encoded.
Apr 5, 2022 Juan Antonio González Mena
How to Get Started in Bug Bounty
Complete guide to getting started in the bug bounty world, including platforms, tools, VPS, methodology, and tips for finding vulnerabilities.
Apr 1, 2022 Eric Labrador
DOM XSS in document.write sink using source location.search inside a select element – PortSwigger Write Up
Learn how to exploit DOM XSS in document.write by escaping from a select element and executing arbitrary JavaScript code.
Mar 31, 2022 Juan Antonio González Mena
Reflected XSS into a JavaScript string with angle brackets HTML encoded – PortSwigger Write Up
Learn how to exploit a Reflected XSS inside a JavaScript string in PortSwigger Lab. Step-by-step guide to escape from a string and execute JavaScript code when angle brackets are HTML-encoded.
Mar 30, 2022 Juan Antonio González Mena
Stored XSS into anchor href attribute with double quotes HTML-encoded – PortSwigger Write Up
Learn how to exploit a Stored XSS in the href attribute of an anchor in PortSwigger Lab. Step-by-step guide to execute JavaScript when clicking on the comment author's name when double quotes are HTML-encoded.
Mar 29, 2022 Juan Antonio González Mena