Web App Penetration Testing - #10 - XSS(Reflected, Stored & DOM)

Value of the Information & Strength of the Argument

The video provides practical, hands-on demonstrations of three XSS types, clearly explaining the underlying mechanics and the differences between each. The presenter’s approach emphasizes understanding over speed, which helps beginners grasp the core concepts. The argumentation is logical, building from basic principles to concrete examples, and the choice of using purposely vulnerable applications is appropriate for educational purposes. The demonstrations are clear, and the presenter explains why certain payloads work, such as pointing out validation deficiencies in the low-security setting.

Scientific Rigor, Source Quality, Title Accuracy

The tutorial is technically sound, using recognized OWASP tools for exploitation. The presenter explains each step and the rationale behind the attacks, avoiding unsupported claims. Sources include the OWASP BWAP project page and a WebGoat documentation reference, which are reliable. The title accurately reflects the content, as the video systematically covers reflected, stored, and DOM XSS. No discrepancies were found between the title and the presented material.

Le titre correspond parfaitement au contenu, qui couvre les trois types de XSS mentionnés.

8/10

The video is a practical demonstration of XSS attacks with clear explanations of underlying concepts. The presenter uses well-known vulnerable applications (OWASP BWA, WebGoat) and thoroughly explains the mechanics of each XSS type. Content is accurate and aligned with established security knowledge, although it doesn't include recent developments or advanced bypass techniques.

Markers derived by PSI from the transcript: the creator did not define chapters.

• 01:00Introduction to the video and environment setup with OWASP BWAP.
• 03:30Explanation of what Cross-Site Scripting is and the three types (reflected, stored, DOM).
• 05:30Demonstration of reflected XSS using a GET request and alert payload.
• 08:30Introduction to stored XSS and how it differs from reflected.
• 10:00Demonstration of stored XSS in a blog comment field, showing persistent execution.
• 13:00Explanation of DOM-based XSS, focusing on client-side processing with WebGoat.
• 14:30Demonstration of DOM XSS using an HTML img tag and onerror event.
• 16:00Summary and preview of future videos on high-security bypass techniques.

• OWASP Broken Web Applications Project — Used as the primary testing environment in the video.
• HackerSploit Website — Presenter's official website for additional resources.
• HackerSploit Android App — Promoted in the description for accessing content.

• OWASP XSS Prevention Cheat Sheet — Confirms the techniques and risk described in the video.
• PortSwigger Research on XSS — Provides additional perspective on XSS attack vectors.

• nordvpn.org
• www.udemy.com