Live XSS Exploit: Using XSSFuzz to Break CSP on a Real Target!

In this video, I demonstrate how to exploit a live target using a powerful tool called XSSFuzz to uncover XSS vulnerabilities through a misconfigured CSP (Content Security Policy). Watch as I take you step-by-step through the process, revealing how XSSFuzz makes it easier to bypass security measures and find hidden vulnerabilities. By the end, you'll see a real-world XSS exploit in action, showing just how critical it is to have a properly configured CSP. Don't miss out on this thrilling demonstration of web security in action!
xssFuzz: github.com/Asp...
Previous Video: • Chaining Vulnerabiliti...
Finding XSS in 2024: • Bug Bounty: Best Way T...
Website: bepractical.tech
Telegram: telegram.me/be...
Previous Video: • Covering The Under Rat...
The Art Of Web Reconnaissance:
www.udemy.com/...
Hacking Windows with Python from Scratch: www.udemy.com/...
The Ultimate Guide to Hunt Account Takeover:
www.udemy.com/...

[@BePracticalTech]

xssFuzz: github.com/Asperis-Security/xssFuzz/

[@MustafaGains]

This tool really helpful and time saving. it’s just give us a hint of weakness points in the CSP So that we can move forward to focus of this weakness to get an xss. ppl really dont even wanna read about the tool to understand what’s the tool purpose and what’s doing for us to use it correctly.

[@haxonit]

finally found a video where the youtuber is not saying to test out random payloads

[@franciscomesquita2023]

Very good" More videos on xss stored.

[@Offended.]

great content

[@raghs3889]

nice video... thank you very much

[@abdulx01]

This is like generation base fuzzing. But its not enough to break sanitizer waf. You can add more mutation strategies.

[@paramjeetsinghthiara1807]

Great! 👍 Got to learn new technique

[@BePracticalTech]

I am glad!

[@RajuHa-g3m]

Make a video on dom base xss please

[@uttarkhandcooltech1237]

❤❤❤❤ love u bhai

[@CyberSecHemmars]

I was testing a web app and I injected a simple XSS alert(); but after reading the source, i noticed that the dangerous character were swapped with HTML escape character, for example "

[@BePracticalTech]

Generally they are considered to be safe! However there are certain scenarios where we can still get xss if the mitigation is weak or if it the value is reflecting in some interesting areas( like within a js code etc)

[@vongochoanglam6328]

can u rcm me the book or course tutorial for ctf web exploit

[@musabsk]

is it possible to test multiple urls at a time, kindly suggest

[@BePracticalTech]

@@musabsk I believe Asperis Security will release this feature in the next version!

[@SecureByBhavesh]

First 🥇

[@govindkumarjha2500]

It accept payload like: ">alert(1) ???

[@BePracticalTech]

Yes

[@Prince-zu5uj]

Sir which vps u r using?

[@BePracticalTech]

Contabo

[@akhilreddy9753]

Should we do it by giving blind xss payload also

[@BePracticalTech]

Please elaborate

[@akhilreddy9753]

@@BePracticalTech you are created you own server and add the path where you setup the T.txt file . Instead we also do like same thing in blind xss payload also . Like

[@RajuHa-g3m]

He want to say like he gives his blind xss payload and then check for xss but it doesn't make any sense he can try manually also for blind xss ​@@BePracticalTech

[@lakshaygamerlt4032]

give you xss payloads

[@BePracticalTech]

@@lakshaygamerlt4032 There are cusom payloads already present in the tool

[@Max-mz3is]

this tool doesn't work and not reliable at all try to run it against testphp it doesn't come up with basic xss such crap

[@BePracticalTech]

@@Max-mz3is As I have mentioned in the video, this tool is not your typical xss automation tool. It is more like fuzzing the xss payload's components like tags, events etc However, if you want to automate xss with this tool then you can use the xss payloads file and it will work without any issues. I would suggest you to watch the whole video and understand how to use this tool