# Cross-Site Scripting (XSS)

> Master the art of client-side injection. Learn to identify, exploit, and weaponize Reflected, Stored, and DOM-based XSS vulnerabilities to hijack user sessions.

Canonical: https://codelivly.com/rooms/cross-site-scripting-xss
Last updated: 2026-07-13

| | |
|---|---|
| Level | Beginner |
| Category | Cybersecurity |
| Lessons | 5 |
| Estimated time | 30 min |
| XP | 200 |

Cross-Site Scripting (XSS) is consistently ranked among the most prevalent and dangerous web vulnerabilities. Amateurs think XSS is just popping an  box and calling it a day. When a WAF blocks it, they assume the application is secure. Professionals know that XSS is a gateway to total account takeover, credential theft, and lateral movement. They understand how browsers parse HTML, JavaScript, and attributes, and they know how to break out of any execution context. They don't just find XSS; they weaponize it to steal session cookies, bypass Content Security Policies (CSP), and turn the victim's browser into a proxy for internal network attacks. In this module, we transition from basic payload dropping to advanced client-side exploitation. You will learn to map execution contexts, craft sophisticated polyglots, bypass modern browser defenses, and execute post-exploitation actions that demonstrate real business impact.

## Lessons

1. What is XSS & Its Real-World Impact (30 min)
2. Reflected XSS — Finding & Exploiting (30 min)
3. DOM-Based XSS Explained (30 min)
4. Bypassing Basic Input Filters & WAFs (30 min)
5. Guided Lab: Stealing a Session Cookie via XSS (30 min)

## Related

- [Learning path: Exploitation Fundamentals](https://codelivly.com/learning-paths/exploitation-fundamentals)
- [All rooms](https://codelivly.com/rooms)