Reflected XSS into HTML context with most tags and attributes blocked | portswigger

[@rolobull]

Thanks mate. Very well explained. Lot better than the one posted in the official portswigger.

[@mayankchauhan4788]

Great explaination!!This is the only video with proper explaination of tags and attributes used.!!

[@Dpoint0]

Glad you liked it :)

[@karthikmp5590]

I was so confused when I was solving labs..... Every video I saw all they did was just copy n paste the solution ....I saw your video... You explanation was on point🔥👌... And my doubts are clear now.... Good work.... And please make videos on all labs and make it a playlist... It will be a great help bro✌️👍

[@Dpoint0]

Thanks buddy

[@JohnBuggy]

Nice one matey....fell right in to that bear trap you described!! THANKS!!

[@Dpoint0]

Haha yeah silly thing

[@jorgsnjoroge4869]

Perfect explanation 👌

[@ahmedkasmi7194]

the best explantion ever thanks mate plz rock on

[@manikeshtechtube4490]

I'm thankful to you, i found many solution for this but I couldn't find a proper explanation

[@Dpoint0]

do subscribe to support, glad it was helpful

[@HarshSenpaiRocks]

Great Great Explanation and Really Like your Thought Process.

[@Dpoint0]

Please do subscribe and share mate :)

[@itsm3dud39]

does reflected xss show in POST?

[@Esola11]

thank you man for this detailed explanation

[@ahmedabdellaoui796]

thanks for the explanation can you please explain to me why we used

[@Dpoint0]

here block means the tags which are handled by the developer so cant use them to intrude. hence found out that is something which is not handler by the code hence used that tag for intruding.

[@MalluDiscoveryTV]

thanks :)

[@randomtrends1545]

clearly explained great keep doing

[@maheshpatel9435]

Very well explained, plz make more videos on port swigger labs

[@Dpoint0]

Sure I will thank you #dpoint

[@sisirkantabehera1035]

How run two application side by side on kali??

[@Dpoint0]

Use terminal to run apps , or webapps drag side by side manually If I didn't answer you properly Can you reprashe your question

[@chamathblack9203]

Well explained. Thanks

[@nmahesh7498]

good content and great effort

[@Dpoint0]

Thanks mate

[@bongamerzz1898]

Your videos are an excellent addition to my Bug Bounty curriculum. Thanks for all the efforts. Keep up ! BTW while configuring the attack in 'Target' tab, using the HTTPS checkbox depends on the protocol of the website right?

[@Dpoint0]

yes bonny, and thanks for appreciative comment

[@Beast-cc7xd]

Good videos man . I have a question : why in the minute 8:40 you put %20 next to the body? thanks man your videos are amazing

[@Dpoint0]

thats url encoded format of space

[@Beast-cc7xd]

@@Dpoint0 thanks for your response , awsome videos !

[@Stas1983ful]

Does we use this exploit server for send link (with this ) to victim/ and when victim open link in browser, his cookie will stealling?

[@Dpoint0]

Right that is basically executing something on client machine

[@Stas1983ful]

@@Dpoint0 thank you bro :)

[@darkdevil3167]

must have start and end tag right????

[@ashwanipayal5635]

any luck on ur question // i m also having same impression .

[@a.k.7605]

great video.. thank you..!!

[@Dpoint0]

:) welcome

[@nimaasadi730]

you teach very nice please add subtitle for your videos

[@muhammadhuzaifa8570]

nice video bro.

[@officialwootz]

Nice explanation Bro :)

[@Dpoint0]

Glad you liked it! :)

[@rahulshah1559]

i still dont get it, what is the purpose of exploit server and how/why does it work

[@Dpoint0]

I think i replied to this previously, but if still, doubt persist you can post here maybe: portswigger.net/support - even I will follow the post bro

[@rahulshah1559]

@@Dpoint0 thanks bro, im on streak of solving portswiggers labs, i would really love to have a bit of your guidance. you own any discord servers or community?

[@Dpoint0]

Bro even I am new bie, so yeah we can discuss. you can find discord link in about section

[@mdyiaz6138]

where did you get this code??

[@Dpoint0]

its in the portswigger solution

[@purvashgangolli5968]

thank you so much bro

[@Dpoint0]

Always welcome

[@jessy6922]

well explained

[@Dpoint0]

Thanks mate 😊

[@mohamedabuelyouser3632]

great man keep going

[@Dpoint0]

Glad you like it mate :)

[@recon0x095]

awesome explanation bro Can you explain this - > "Reflected XSS with event handlers and href attributes blocked" from portswigger.

[@Dpoint0]

if its not part of playlist, means the concept is similar to something already covered. Let me know if you are struck anywhere. Will surely help you :)

[@AhmedSalah-fi3dt]

what is the purpose of =100

[@Dpoint0]

can you provide timestamp

[@AhmedSalah-fi3dt]

@@Dpoint0 9:35

[@AhmedSalah-fi3dt]

And also idont understand what is the purpose of exploit server

[@Dpoint0]

@@AhmedSalah-fi3dt as i have mentioned on 7:43 to get in attr=value format I used 100 as value, you can use anything, just we want our payload in the proper format, And exploit server means server in which attackers code is present, that is server is compromised and will affect the end-user

[@kranelcubic1286]

finally you cutted your hair

[@Dpoint0]

haha have a good day ahead

[@ashwanipayal5635]

hi good explaination , but please advise for tag should look like this ....but if we dcode the solution it come like this : " onload=this.style.width='100px' my question is why on load and on resize attribute did not come inside opening tag of i frame . they are coming after opening tag and also i do not see any closing tag for i frame also. also , could not understand the purpose of double quote after print function.