Posted in Blog, PortSwigger

PortSwigger Web Academy – 11 XSS

On to the client-side! I spent about half of this section smacking myself for not having as much dev experience as I would like. At some point I’ve got to pick up a bit more JavaScript, but it’s really not been a priority. That lack of experience made this section particularly challenging. To the point I left 2 of the labs incomplete because they are expert level and I’m hoping they’ll make more sense after working through more of the client-side topics. Don’t get me wrong, the labs are great (and plentiful!) – it’s just content that I’m way less familiar with when it gets into the more complicated exploits.

There is a lot of content in this section. I think going through all of the content and then doing the labs would have been a better approach for me. I am having to fill in some gaps to understand what’s going on. I think it would be beneficial to take a quick JavaScript intro module before I revisit these labs. If you’ve done XSS labs previously, the first few should be familiar. I found most of the apprentice levels ones that I knew what I wanted to do, but I didn’t really remember how to do it. That’s a feature of not doing much web app pen testing over the past few years, so I’m not real surprised. I’m thinking after going through the other client-side modules I’ll have gotten back in that headspace enough to make the XSS make a bit more sense.

The biggest takeaways for me in this section were seeing what the payloads would look like in the logs. That’s the big reason for wanting to go through this material. I’ve lost a bit of momentum between taking several courses and trying to focus more on my threat hunting course. Priorities…shrug.

I do feel like I’ll be rearranging the order for client-side as well. I found the CSRF section made more sense (more on that later) based on what was done in the server-side modules. I think I also ran into a bit of just wanting to be done with the XSS section. I probably would have benefited from breaking and doing a different module then coming back. There are 30ish XSS labs (PortSwigger says 30, some how I’ve ended up with 33 in my notes, but that may be from doing ones they put elsewhere working while I was working through the content) . It’s by far the most concentrated and in-depth group of XSS labs I’ve gone through.

I think if you are coming in to this section with very little familiarity with JavaScript, it would be a good idea to go through at least an intro module like you would find on Codecademy or SoloLearn. I’d started the Codecademy Learn JavaScript intro a long time ago – I think taking the couple hours to finish that would be beneficial before revisiting the XSS stuff. The people I’ve talked to with stronger development backgrounds found this unit pretty easy. I’m really happy with what was covered and feel like I can use it to build out a decent framework for testing. I just know there are some knowledge gaps I would need to fill if web app pen testing was my main focus. Too many things I want to learn and not enough time.


Lifelong paradox - cyber sec enthusiast - loves to learn

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.