https://blog.mingon.dev/tags/stored-xss/Recent content in Stored XSS on 보안 연구 노트Hugo -- gohugo.ioko-KRSat, 06 Jun 2026 18:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---exploiting-xss-to-bypass-csrf-defenses/Sat, 06 Jun 2026 18:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---exploiting-xss-to-bypass-csrf-defenses/Stored XSS로 피해자의 계정 페이지에서 CSRF 토큰을 읽고 이메일 변경 요청을 전송하는 공격 연계 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---exploiting-cross-site-scripting-to-capture-passwords/Sat, 06 Jun 2026 15:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---exploiting-cross-site-scripting-to-capture-passwords/Stored XSS로 로그인 입력 요소를 삽입해 브라우저의 자동 완성 값을 획득하고 피해자 계정으로 로그인하는 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---exploiting-cross-site-scripting-to-steal-cookies/Sat, 06 Jun 2026 12:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---exploiting-cross-site-scripting-to-steal-cookies/댓글의 Stored XSS를 이용해 피해자의 세션 쿠키를 유출하고 해당 세션으로 사용자를 사칭하는 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---stored-xss-into-onclick-event-with-angle-brackets-and-double-quotes-html-encoded-and-single-quotes-and-backslash-escaped/Fri, 05 Jun 2026 15:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---stored-xss-into-onclick-event-with-angle-brackets-and-double-quotes-html-encoded-and-single-quotes-and-backslash-escaped/댓글 Website 값이 onclick의 JavaScript 문자열에도 삽입되는 지점에서 HTML 엔티티 디코딩을 이용해 이스케이프를 우회하는 Stored XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---stored-dom-xss/Thu, 04 Jun 2026 09:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---stored-dom-xss/댓글 데이터를 innerHTML에 삽입하기 전 replace로 첫 꺾쇠만 치환하는 불완전한 이스케이프를 우회하는 Stored DOM XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---stored-xss-into-anchor-href-attribute-with-double-quotes-html-encoded/Tue, 02 Jun 2026 18:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---stored-xss-into-anchor-href-attribute-with-double-quotes-html-encoded/댓글의 Website 값이 작성자 링크 href에 저장되는 지점에 javascript URL을 삽입하는 Stored XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---stored-xss-into-html-context-with-nothing-encoded/Mon, 01 Jun 2026 12:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---stored-xss-into-html-context-with-nothing-encoded/댓글 본문에 저장된 script 태그가 게시글을 조회하는 사용자의 브라우저에서 실행되는 기본 Stored XSS 풀이