Cross-Site Scripting (XSS)

Cross-platform resources for Cross-Site Scripting (XSS): curated HTB machines, PortSwigger labs and TryHackMe rooms with validated writeups and related skills.

Cross-Site Scripting (XSS)

This page aggregates cross-platform resources to practice Cross-Site Scripting (XSS): retired Hack The Box machines, PortSwigger Web Security Academy labs and TryHackMe rooms, plus curated resources (HackTricks, PortSwigger, etc.) and related skills.

Curated resources

Source	Link
HackTricks	https://book.hacktricks.wiki/en/pentesting-web/xss-cross-site-scripting/index.html
PortSwigger	https://portswigger.net/web-security/cross-site-scripting

HTB machines practicing Cross-Site Scripting (XSS) (13)

Machine	OS	Difficulty
Anubis	Windows	INSANE
Bankrobber	Windows	INSANE
Book	Linux	MEDIUM
CrossFit	Linux	INSANE
EarlyAccess	Linux	HARD
Holiday	Linux	HARD
Nightmare	Linux	INSANE
OverGraph	Linux	HARD
Quick	Linux	HARD
RedCross	Linux	MEDIUM
Schooled	Linux	MEDIUM
SecNotes	Windows	MEDIUM
Stacked	Linux	INSANE

PortSwigger labs practicing Cross-Site Scripting (XSS) (36)

Lab	Difficulty	Topic	Official
DOM XSS in document.write sink using source location.search	APPRENTICE	Cross-Site Scripting (XSS)	Open
DOM XSS in innerHTML sink using source location.search	APPRENTICE	Cross-Site Scripting (XSS)	Open
DOM XSS in jQuery anchor href attribute sink using location.search source	APPRENTICE	Cross-Site Scripting (XSS)	Open
DOM XSS in jQuery selector sink using a hashchange event	APPRENTICE	Cross-Site Scripting (XSS)	Open
Exploiting DOM clobbering to enable XSS	APPRENTICE	DOM-based Vulnerabilities	Open
Reflected XSS in a JavaScript URL with some characters blocked	APPRENTICE	Cross-Site Scripting (XSS)	Open
Reflected XSS into a JavaScript string with angle brackets HTML encoded	APPRENTICE	Cross-Site Scripting (XSS)	Open
Reflected XSS into attribute with angle brackets HTML-encoded	APPRENTICE	Cross-Site Scripting (XSS)	Open
Reflected XSS into HTML context with nothing encoded	APPRENTICE	Cross-Site Scripting (XSS)	Open
Reflected XSS protected by CSP, with CSP bypass	APPRENTICE	Cross-Site Scripting (XSS)	Open
Reflected XSS with event handlers and href attributes blocked	APPRENTICE	Cross-Site Scripting (XSS)	Open
Stored XSS into anchor href attribute with double quotes HTML-encoded	APPRENTICE	Cross-Site Scripting (XSS)	Open
Stored XSS into HTML context with nothing encoded	APPRENTICE	Cross-Site Scripting (XSS)	Open
DOM XSS in AngularJS expression with angle brackets and double quotes HTML-encoded	PRACTITIONER	Cross-Site Scripting (XSS)	Open
DOM XSS in document.write sink using source location.search inside a select element	PRACTITIONER	Cross-Site Scripting (XSS)	Open
DOM XSS using web messages	PRACTITIONER	DOM-based Vulnerabilities	Open
DOM XSS using web messages and a JavaScript URL	PRACTITIONER	DOM-based Vulnerabilities	Open
DOM XSS using web messages and JSON.parse	PRACTITIONER	DOM-based Vulnerabilities	Open
DOM XSS via an alternative prototype pollution vector	PRACTITIONER	Prototype Pollution	Open
DOM XSS via client-side prototype pollution	PRACTITIONER	Prototype Pollution	Open
Exploiting clickjacking vulnerability to trigger DOM-based XSS	PRACTITIONER	Clickjacking	Open
Exploiting cross-site scripting to capture passwords	PRACTITIONER	Cross-Site Scripting (XSS)	Open
Exploiting cross-site scripting to steal cookies	PRACTITIONER	Cross-Site Scripting (XSS)	Open
Exploiting HTTP request smuggling to deliver reflected XSS	PRACTITIONER	HTTP Request Smuggling	Open
Exploiting XSS to bypass CSRF defenses	PRACTITIONER	Cross-Site Scripting (XSS)	Open
Reflected DOM XSS	PRACTITIONER	Cross-Site Scripting (XSS)	Open
Reflected XSS in canonical link tag	PRACTITIONER	Cross-Site Scripting (XSS)	Open
Reflected XSS into a JavaScript string with angle brackets and double quotes HTML-encoded and single quotes escaped	PRACTITIONER	Cross-Site Scripting (XSS)	Open
Reflected XSS into a JavaScript string with single quote and backslash escaped	PRACTITIONER	Cross-Site Scripting (XSS)	Open
Reflected XSS into a template literal with angle brackets, single, double quotes, backslash and backticks Unicode-escaped	PRACTITIONER	Cross-Site Scripting (XSS)	Open
Reflected XSS into HTML context with all tags blocked except custom ones	PRACTITIONER	Cross-Site Scripting (XSS)	Open
Reflected XSS into HTML context with most tags and attributes blocked	PRACTITIONER	Cross-Site Scripting (XSS)	Open
Reflected XSS protected by very strict CSP, with dangling markup attack	PRACTITIONER	Cross-Site Scripting (XSS)	Open
Reflected XSS with some SVG markup allowed	PRACTITIONER	Cross-Site Scripting (XSS)	Open
Stored DOM XSS	PRACTITIONER	Cross-Site Scripting (XSS)	Open
Stored XSS into onclick event with angle brackets and double quotes HTML-encoded and single quotes and backslash escaped	PRACTITIONER	Cross-Site Scripting (XSS)	Open

TryHackMe rooms practicing Cross-Site Scripting (XSS) (10)

Room	Difficulty	Type	Access	Official
25 Days of Cyber Security	EASY	Walkthrough	🟢 Free	Open
Advent of Cyber 2 [2020]	EASY	Walkthrough	🟢 Free	Open
Custom Tooling Using Python	EASY	Walkthrough	🟢 Free	Open
Intro to Cross-site Scripting	EASY	Walkthrough	🔵 VIP	Open
Learn Rust	EASY	Walkthrough	🟢 Free	Open
OWASP Juice Shop	EASY	Walkthrough	🟢 Free	Open
Web Application Basics	EASY	Walkthrough	🟢 Free	Open
XSS	EASY	Walkthrough	🟢 Free	Open
XSS - Merry XSSMas	EASY	Walkthrough	🟢 Free	Open
NahamStore	MEDIUM	Challenge	🟢 Free	Open

Related skills

• /en/skills/sqli
• /en/skills/ssrf

---

← Back to the full glossary

Last updated: 2026-05-09