XSS Tutorial — One-Page Cheat Sheet

Cross-Site Scripting — how it works and how to stop it.

XSS

• HOME
• Intro
• How It Works
• Reflected XSS
• Stored XSS
• DOM-based XSS
• Mutation XSS
• Impact & Risk
• Safe Demo Lab

Prevention

• Output Encoding
• Context-Aware Encoding
• HTML Sanitisation
• Auto-escaping Frameworks
• DOMPurify
• Trusted Types
• Content Security Policy
• HttpOnly / SameSite Cookies
• Dangerous href / src

Detection & Hardening

• Code Review Checklist
• Lint / no-inner-html
• SAST Tooling
• DAST Tooling
• CSP Reporting
• WAF / RASP

Examples

• Examples
• Cheatsheet
• Quiz
• Exercises
• Bootcamp
• Certificate
• Summary