Cross-Site Scripting (XSS): The Practical Guide

Heard of XSS but not quite sure what it is? With this course, you'll not only learn the 3 major types, but you'll compromise sample apps and learn how to defend your applications against one of the most serious threats facing web apps today.

"Cross-site Scripting (XSS) continues to be the most awarded vulnerability type with US$4.2 million in total bounty awards, up 26% from the previous year."

Source: HackerOne

$ 19

Video and written lessons
Lifetime access
Downloadable ebook

$34.98

$ 24

Save 29% - Bundle Discount
Course & Ebook bundle
Video and written lessons
Downloadable ebook version of the course
Lifetime access

Best value

$ 14

Downloadable ebook version of the course
Lifetime access
Videos

Here's what you get

5h

37 Lessons

Beginner-Intermediate

We believe in practical learning

Covering concepts is important, but applying those concepts is even more important. This course has about 30% concepts and 70% practical.

Learn about the different types of XSS attacks

There are 3 main types of XSS attacks: Reflected, stored (or Persisted), and DOM-based. Each type has differences which are important to understand because they change how you approach both attacking and defending an application.

Study real case studies

We take a look at real-world XSS from companies like Tesla, Google, Airbnb, and Facebook from Bug Bounties that resulted in tens of thousands of dollars in payouts. For example, one of the studied case studies was Blind XSS from a Tesla Model 3. Super cool.

Perform manual & automated attacks against legal apps

After you’ve learned the concepts of XSS, it’s time to get practical. In this section of the course, we apply the concepts we’ve learned to practice finding vulnerabilities, crafting successful payloads, and exploiting vulnerabilities. We’ll even use the popular exploitation framework called BeEF to hook a simulated victim and control their browser remotely.

Follow along with guided labs, or try techniques of your own!

Learn how to make your apps secure

In the last section of the course, we learn best practices and techniques to defend against the three types of XSS attacks. We take a side-by-side look at vulnerable versus secure code, we review in-depth cheat sheets and rules, as well as recommended code review techniques.

What students say about our courses

Cybr Learners

10000 +

Avg Course Ratings

4 +

"I have to say that these are the most thorough, comprehensive and well-structured courses of study that I have found. Ever. And over the course of the last 3-4 years, I have wasted a lot of money on online courses that turned out to be nothing more than rudimentary demos of this, that, or the other ‘hacking’ technique. Pro Tip: If the course title is something along the lines of ‘Ethical Hacking, The Complete Course’, stay away. Anybody can put together a set of videos and call it a course. But it is rare to find a true subject matter expert who is also a good instructor. And even rarer is it possible to find that combination with a well-structured course of instruction. Such are your courses."

Tom Derenthal

Cybersecurity Analyst

"This course is great and I would recommend it to anyone trying to learn about web-pentesting or trying to pursue bug bounty as this course gives you a good basis on XSS with a lot of hands-on work."

Bludger

Cybr learner

"This is a great course, with extremely well structured lectures, very clear and detailed explanations and lots of examples so students can understand the concepts. The course content is precise and the instructor is very knowledgeable, engaging and keeps learners interested in the material."

Bruna S.

Cybr learner

"Great course, I recommend it"

Paulina Brzozowska

Cybr learner

"I've got about 3 years in software security with about 23 years in information and DOD security. While I was familiar with XSS I always thought it was a unique and not so dangerous vulnerability. Your course showed me just how damaging XSS could be, and the various ways to assess and mitigate XSS vulnerabilities. I’ll be incorporating your tools and processes in the way I work with teams to evaluate their products."

Matthew H.

Cybr learner

"Very good info every developer should be aware of (at least know where to look for it)"

Mircea Goga

Cybr learner

"Great insight in XSS. I liked the exercises and practical examples, which give a good feeling for what XSS is and how and where it works."

Anonymized User

Cybr learner

"Absolutely fantastic. THANK YOU"

Adon Delpit

SOC Analyst

"The tools used are really great and the explanations are very precise."

Juan Jasso

Cybr learner

"Very good explanations and walkthrough of many of the concepts of XSS. Much better than several other overview courses I've seen."

Robert King

Cybr learner

Trusted by Higher Ed partners

But wait, there's even more

With your purchase, you also get access to…

Frequently Asked Questions

Is there a money-back guarantee?

If you aren’t satisfied with your purchase, we will provide you with a full refund as long as you contact us within 30 days of purchase.

Is it a one-time fee?

Yes! Buy it once and it’s yours to keep! Zero hidden fees.

What's the difference between the Course and Ebook?

The course is a full-featured online course with guided videos and written lessons. The ebook is the same content without the guided video lessons, and it can be downloaded offline. The bundle offers both in one purchase!

Is there a community to go along with the course?

Yes! Interact as little or as much as you’d like with other students taking the same course. We have a Discord community and our Forums.

Cross-Site Scripting (XSS): The Practical Guide

Heard of XSS but not quite sure what it is? With this course, you'll not only learn the 3 major types, but you'll compromise sample apps and learn how to defend your applications against one of the most serious threats facing web apps today.

Course

Bundle

Ebook

Here's what you get

5h

37 Lessons

Beginner-Intermediate

Author support

We believe in practical learning

Learn about the different types of XSS attacks

Study real case studies

Perform manual & automated attacks against legal apps

Learn how to make your apps secure

What students say about our courses

Trusted by Higher Ed partners

But wait, there's even more

Free courses

Cybr's Community

Frequently Asked Questions