Bug › Module 6 › Lesson 1
XSS Named
Cross-site scripting literacy on $PROGRAM in-scope assets — hunter mindset and defender notes, not stranger exploit cookbooks.
Visual · t20_xss_named
XSS = untrusted input reaches browser execution context. $PROGRAM scope only. Original Cyberlium.
Opening
Learn what reflected, stored, and DOM XSS mean so you can report and defend — not spray payloads on sites you never joined.
Cross-site scripting (XSS) occurs when attacker-controlled input is reflected or stored and executed in a victim's browser context — enabling session abuse, UI manipulation, or chained impact depending on app design. Hunters think in contexts: HTML body, attribute, JavaScript string, URL — and whether CSP, encoding, or framework defaults block execution. Cyberlium teaches XSS categories (reflected, stored, DOM), CWE-79 literacy, and defender controls (output encoding, CSP, HttpOnly cookies) on assets listed in YOUR enrolled $PROGRAM scope or intentional $LAB_BOUNTY — not kitchen-sink payload lists for random SaaS, not mass scanning out-of-scope subdomains, no phishing templates, no stealing real user sessions from strangers. Validation = minimal proof on in-scope / lab; one alert or harmless DOM marker beats dumping victim cookies.
1. XSS categories (literacy)
Reflected: input echoed in response. Stored: input persisted and served to others. DOM: client-side sink without server round-trip — name the category in reports.
Hunter question: where does untrusted data enter, and which sink executes it? Map from YOUR asset inventory — not blind payload fuzz on every parameter.
Command guide
Try these commands — XSS categories (literacy)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
XSS literacy — injection into HTML/JS context (no weaponized payloads) OWASP XSS — https://owasp.org/www-community/attacks/xss/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install jq
macOS:
Command — copy this
brew install jq
Windows: Built-in (PowerShell: Invoke-WebRequest)
Command — copy this
choco install jq
═══ LINUX / macOS ═══
Command — copy this
curl -sS 'https://httpbin.org/get?q=test&ref=lab' | jq '.args' curl -sS https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html | head -5
Primary tools to practice this lesson: curl, jq. Reference sites: XSS literacy; OWASP XSS (https://owasp.org/www-community/attacks/xss/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender controls
Context-aware output encoding, Content-Security-Policy, HttpOnly/Secure cookies, framework auto-escaping, sanitize only as last resort with allowlists.
Monitor for anomalous script injection in logs; treat XSS as impact-dependent — session on sensitive app vs static marketing page.
3. Scope boundary
Test XSS hypotheses only on $PROGRAM in-scope hosts you enrolled or $LAB_BOUNTY per brief — read program rules on self-XSS and automation.
No XSS PoCs on out-of-scope assets, no mass parameter spraying, no social-engineering victims to click your link on production strangers.
4. What you ship: XSS literacy card
Three XSS types + hunter sink/source question + two defender controls + $PROGRAM-only sentence.
5. What you record before the next lesson
XSS literacy card path.
6. Wrong vs right: random sites vs in-scope program
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run XSS payload lists against every URL on the internet 'for practice.'
Right
Name XSS types and defenses on enrolled scope. Next: IDOR Named.
Mission: XSS literacy card
1) Define reflected, stored, DOM in one line each. 2) Write hunter source→sink question. 3) Name two defender controls. 4) Write NEVER on unenrolled sites.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Self-XSS — when is it reportable on $PROGRAM?”
Knowledge Check
APPLY: XSS on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Mass XSS fuzzing on unenrolled sites is bounty practice.
True or False
Knowledge Check
APPLY: Defenders reduce XSS with:
Multiple choice