Bugcrowd University - Cross Site Scripting (XSS)

[@domaincontroller]

00:44 overview 01:22 Module reading 02:18 history =================================== DIFFERENT CLASSES OF XSS =================================== 05:38 reflective XSS 06:09 stored XSS 06:36 Flash-based XSS 07:03 self-XSS =================================== CLASSIC EXAMPLES OF XSS =================================== 07:37 MySpace worm, stored XSS 08:10 Tweetdeck worm, stored XSS =================================== BEST EXAMPLES OF XSS =================================== 08:27 start slow [...], don't get discouraged, keep a list of common payload =================================== DOM XSS =================================== 11:07 Advances of XSS 11:24 DOM XSS is one of the hardest variation of XSS to find because it requires a little bit more advanced knowledge 11:40 and within that function is a call to a variable that can be injected into via query string or post body parameter 11:46 DOM XSS is notoriously hard to find for many beginners and intermediate-level testers 11:53 sources and sinks 12:23 sources 12:59 what does it look like 13:46 example, XSS Polyglot 1 14:40 polyglot 2 14:55 polyglot 3 =================================== BLIND XSS =================================== 15:07 Blind XSS =================================== tooling =================================== 16:09 XSS hunter

[@edgob9910]

Patrice Kenmoé damm you wrote all this 👍🏼

[@assistedpropertysale4629]

Thanks to Bugcrowd for giving you the opportunity to present this as well as thank you very much, Jason, as well as everyone that contributed to this presentation. Best Regards

[@BearMeOut]

Interesting point 8:57 start slowly 13:50 what's a polyglot 17:21 recommend mind map

[@medi7573]

we are REALLY enjoying and learning what the channel is providing ,and please more of this amazing content.

[@SuperMarkusparkus]

There are two definitions of self-xss. The other is that the user can impose xss on his own user account. If combined with login-csrf it can have the same impact as a regular xss.

[@namenone8387]

Thank you so much for this content, Please keep it coming. :D

[@DrKeineL]

I am so enjoying this! Thank you thank you so much. Btw I used to check for "hello" to see if its reflecting or not but from now on "swagneto" is my thing lol hope it brings luck!!!

[@deanramos9728]

Thank you for this! Thus made my life easier

[@jackgaming7643]

Amazing explanation sir..

[@Sebavalya]

What's about universal xss ?

[@Ajay-kz6zw]

Super explanation 👍

[@Warlock1515]

Best video I've seen!

[@danz5760]

Do u have to be good at reading JavaScript to find this bug?

[@ELREY1979]

Hi Guys its there a problem with your Video University Tutorials, future updates ? Thanks for you beautifull explanation

[@shubhamwaghmare6550]

Thank you so much for tutorial this is really helpful 😄

[@sanjay010i]

@Bugcrowd Tutorials are execellent. Please make more videos on other topics.

[@royaljaguar9933]

No

[@rpsulli]

In the lab, why do you have to go slow when adding tags, etc ??? why not just start with ?

[@SwainCountry]

Ryan Sullivan - You start with a > to cut off the last value, e.g. an input tag. Some will change it internally to different symbols, you want to test what they block out.

[@root_Mohit30]

amazing content✌️✌️

[@shrirangkahale]

But most of all, Samy is our hero

[@Tekionemission]

(17:20)-XSS MindMap

[@ashutoshraval3255]

Thanks sir pls make more videos 🙏👌

[@sail3sh703]

today someone just reported the xss bug in google translate

[@malikubi1337]

Great thanks for sharing.

[@derelictmanchester8745]

Excellent!!!

[@SuperMarkusparkus]

I would never recommend to use KnoXSS. It's a substandard tool that promises too much.

[@cyberwarrior9403]

very good

[@blazedank100]

Swagneto!

[@nainab9329]

Voice is very low. I had to twice check my volume...