This is a quick list of XSS resource I refer to often.
I've organised research by year to help give a better understanding of how various techniques have evolved over the past few years.
- PortSwigger XSS Labs
- PwnFunction challenges
- Google CTF (Various years)
- Google XSS Game
- Google Firing Range
- alf.nu - Alert(1) to win
This lists interesting XSS related research published over the past few years.
- Google - Prevent DOM XSS with Trusted Types
- Gareth Heyes - Evading defences using VueJS script gadgets
- Gareth Heyes - Bypassing DOMPurify again with mutation XSS
- terjanq - Arbitrary Parentheses-less XSS
- Michał Bentkowski - Mutation XSS via namespace confusion – DOMPurify < 2.0.17 bypass
- Daniel Santos - From SVG and back, yet another mutation XSS via namespace confusion for DOMPurify < 2.2.2 bypass
- Gareth Heyes - XSS without parentheses and semi-colons
- Michał Bentkowski - Write-up of DOMPurify 2.0.0 bypass using mutation XSS
- Michał Bentkowski - Security analysis of <portal> element
- Google - Don’t trust the DOM: Bypassing XSS mitigations via Script gadgets
- Google - Don’t trust the DOM: Bypassing XSS mitigations via Script gadgets (Youtube version)
- Gareth Heyes - DOM based AngularJS sandbox escapes
- Gareth Heyes - Abusing JavaScript frameworks to bypass XSS mitigations