Cross-Site Scripting (XSS)

Cross-platform resources for Cross-Site Scripting (XSS): curated HTB machines, PortSwigger labs and TryHackMe rooms with validated writeups and related skills.

This page aggregates cross-platform resources to practice Cross-Site Scripting (XSS): retired Hack The Box machines, PortSwigger Web Security Academy labs and TryHackMe rooms, plus curated resources (HackTricks, PortSwigger, etc.) and related skills.

Coverage: 59 challenges across 3 platforms — 13 HackTheBox · 36 PortSwigger · 10 TryHackMe. 13 with a Spanish writeup, 21 with a video writeup.

Where to start

Ordered by actual difficulty. At the same level: isolated lab first, then the guided room, and the full machine last.

1. PortSwigger — DOM XSS in document.write sink using source location.search (Apprentice) · 🇬🇧
2. PortSwigger — DOM XSS in innerHTML sink using source location.search (Apprentice) · 🇬🇧
3. PortSwigger — DOM XSS in jQuery anchor href attribute sink using location.search source (Apprentice) · 🇬🇧 📹
4. PortSwigger — DOM XSS in jQuery selector sink using a hashchange event (Apprentice) · 🇬🇧
5. PortSwigger — Exploiting DOM clobbering to enable XSS (Apprentice) · 🇬🇧
6. PortSwigger — Reflected XSS in a JavaScript URL with some characters blocked (Apprentice) · 🇬🇧

Curated resources

Source	Link
HackTricks	https://book.hacktricks.wiki/en/pentesting-web/xss-cross-site-scripting/index.html
PortSwigger	https://portswigger.net/web-security/cross-site-scripting

HTB machines practicing Cross-Site Scripting (XSS) (13)

Machine	OS	Difficulty	Writeup
Anubis	Windows	INSANE	🇪🇸 🇬🇧 📹
Bankrobber	Windows	INSANE	🇪🇸 🇬🇧 📹
Book	Linux	MEDIUM	🇪🇸 🇬🇧 📹
CrossFit	Linux	INSANE	🇪🇸 🇬🇧 📹
EarlyAccess	Linux	HARD	🇪🇸 🇬🇧 📹
Holiday	Linux	HARD	🇪🇸 🇬🇧 📹
Nightmare	Linux	INSANE	🇪🇸 🇬🇧 📹
OverGraph	Linux	HARD	🇪🇸 🇬🇧 📹
Quick	Linux	HARD	🇪🇸 🇬🇧 📹
RedCross	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Schooled	Linux	MEDIUM	🇪🇸 🇬🇧 📹
SecNotes	Windows	MEDIUM	🇪🇸 🇬🇧 📹
Stacked	Linux	INSANE	🇪🇸 🇬🇧 📹

PortSwigger labs practicing Cross-Site Scripting (XSS) (36)

Lab	Difficulty	Topic	Official
DOM XSS in document.write sink using source location.search	APPRENTICE	Cross-Site Scripting (XSS)	Open
DOM XSS in innerHTML sink using source location.search	APPRENTICE	Cross-Site Scripting (XSS)	Open
DOM XSS in jQuery anchor href attribute sink using location.search source	APPRENTICE	Cross-Site Scripting (XSS)	Open
DOM XSS in jQuery selector sink using a hashchange event	APPRENTICE	Cross-Site Scripting (XSS)	Open
Exploiting DOM clobbering to enable XSS	APPRENTICE	DOM-based Vulnerabilities	Open
Reflected XSS in a JavaScript URL with some characters blocked	APPRENTICE	Cross-Site Scripting (XSS)	Open
Reflected XSS into a JavaScript string with angle brackets HTML encoded	APPRENTICE	Cross-Site Scripting (XSS)	Open
Reflected XSS into attribute with angle brackets HTML-encoded	APPRENTICE	Cross-Site Scripting (XSS)	Open
Reflected XSS into HTML context with nothing encoded	APPRENTICE	Cross-Site Scripting (XSS)	Open
Reflected XSS protected by CSP, with CSP bypass	APPRENTICE	Cross-Site Scripting (XSS)	Open
Reflected XSS with event handlers and href attributes blocked	APPRENTICE	Cross-Site Scripting (XSS)	Open
Stored XSS into anchor href attribute with double quotes HTML-encoded	APPRENTICE	Cross-Site Scripting (XSS)	Open
Stored XSS into HTML context with nothing encoded	APPRENTICE	Cross-Site Scripting (XSS)	Open
DOM XSS in AngularJS expression with angle brackets and double quotes HTML-encoded	PRACTITIONER	Cross-Site Scripting (XSS)	Open
DOM XSS in document.write sink using source location.search inside a select element	PRACTITIONER	Cross-Site Scripting (XSS)	Open
DOM XSS using web messages	PRACTITIONER	DOM-based Vulnerabilities	Open
DOM XSS using web messages and a JavaScript URL	PRACTITIONER	DOM-based Vulnerabilities	Open
DOM XSS using web messages and JSON.parse	PRACTITIONER	DOM-based Vulnerabilities	Open
DOM XSS via an alternative prototype pollution vector	PRACTITIONER	Prototype Pollution	Open
DOM XSS via client-side prototype pollution	PRACTITIONER	Prototype Pollution	Open
Exploiting clickjacking vulnerability to trigger DOM-based XSS	PRACTITIONER	Clickjacking	Open
Exploiting cross-site scripting to capture passwords	PRACTITIONER	Cross-Site Scripting (XSS)	Open
Exploiting cross-site scripting to steal cookies	PRACTITIONER	Cross-Site Scripting (XSS)	Open
Exploiting HTTP request smuggling to deliver reflected XSS	PRACTITIONER	HTTP Request Smuggling	Open
Exploiting XSS to bypass CSRF defenses	PRACTITIONER	Cross-Site Scripting (XSS)	Open
Reflected DOM XSS	PRACTITIONER	Cross-Site Scripting (XSS)	Open
Reflected XSS in canonical link tag	PRACTITIONER	Cross-Site Scripting (XSS)	Open
Reflected XSS into a JavaScript string with angle brackets and double quotes HTML-encoded and single quotes escaped	PRACTITIONER	Cross-Site Scripting (XSS)	Open
Reflected XSS into a JavaScript string with single quote and backslash escaped	PRACTITIONER	Cross-Site Scripting (XSS)	Open
Reflected XSS into a template literal with angle brackets, single, double quotes, backslash and backticks Unicode-escaped	PRACTITIONER	Cross-Site Scripting (XSS)	Open
Reflected XSS into HTML context with all tags blocked except custom ones	PRACTITIONER	Cross-Site Scripting (XSS)	Open
Reflected XSS into HTML context with most tags and attributes blocked	PRACTITIONER	Cross-Site Scripting (XSS)	Open
Reflected XSS protected by very strict CSP, with dangling markup attack	PRACTITIONER	Cross-Site Scripting (XSS)	Open
Reflected XSS with some SVG markup allowed	PRACTITIONER	Cross-Site Scripting (XSS)	Open
Stored DOM XSS	PRACTITIONER	Cross-Site Scripting (XSS)	Open
Stored XSS into onclick event with angle brackets and double quotes HTML-encoded and single quotes and backslash escaped	PRACTITIONER	Cross-Site Scripting (XSS)	Open

TryHackMe rooms practicing Cross-Site Scripting (XSS) (10)

Room	Difficulty	Type	Access	Official
25 Days of Cyber Security	EASY	Walkthrough	🟢 Free	Open
Advent of Cyber 2 [2020]	EASY	Walkthrough	🟢 Free	Open
Custom Tooling Using Python	EASY	Walkthrough	🟢 Free	Open
Intro to Cross-site Scripting	EASY	Walkthrough	🔵 VIP	Open
Learn Rust	EASY	Walkthrough	🟢 Free	Open
OWASP Juice Shop	EASY	Walkthrough	🟢 Free	Open
Web Application Basics	EASY	Walkthrough	🟢 Free	Open
XSS	EASY	Walkthrough	🟢 Free	Open
XSS - Merry XSSMas	EASY	Walkthrough	🟢 Free	Open
NahamStore	MEDIUM	Challenge	🟢 Free	Open

Related skills

• /en/skills/sqli
• /en/skills/ssrf

---

← Back to the full glossary

Last updated: 2026-08-17