Reflected XSS into HTML Context with Most Tags and Attributes Blocked

We make use of Burp's intruder feature to brute force different tag and event handler payloads to understand what is being filtered by the WAF and what isn't.

Support This Channel
======================

Please like and subscribe, it means a lot!

Please buy me a coffee so I can continue to make content.

Join our Discord

00:00 Introduction
00:22 Testing WAF behaviour
01:29 Brute force tag test
04:26 Testing for allowed attributes
05:08 Brute force event test
06:26 Analyzing allowed event listeners
07:33 XSS with user interaction
08:44 XSS with no user interaction
10:55 Key takeaways