https://blog.mingon.dev/write-up/portswigger/xss/Recent content in Cross-Site Scripting (XSS) on 보안 연구 노트Hugo -- gohugo.ioko-KRMon, 08 Jun 2026 17:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-protected-by-csp-with-csp-bypass/Mon, 08 Jun 2026 17:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-protected-by-csp-with-csp-bypass/CSP report-uri의 token 파라미터에 script-src-elem 지시어를 주입해 인라인 script 실행을 허용하는 CSP 우회 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-protected-by-very-strict-csp-with-dangling-markup-attack/Mon, 08 Jun 2026 13:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-protected-by-very-strict-csp-with-dangling-markup-attack/외부 리소스를 제한하는 엄격한 CSP에서 누락된 form-action을 이용해 폼 제출 목적지를 바꾸고 CSRF 토큰을 획득하는 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-in-a-javascript-url-with-some-characters-blocked/Mon, 08 Jun 2026 09:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-in-a-javascript-url-with-some-characters-blocked/괄호와 공백이 차단된 JavaScript URL에서 화살표 함수, 전역 onerror, 강제 문자열 변환을 조합해 alert(1337)을 실행하는 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-with-event-handlers-and-href-attributes-blocked/Sun, 07 Jun 2026 17:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-with-event-handlers-and-href-attributes-blocked/이벤트 핸들러와 href 속성이 차단된 환경에서 SVG animate로 링크의 href를 동적으로 javascript URL로 바꾸는 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-with-angularjs-sandbox-escape-and-csp/Sun, 07 Jun 2026 13:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-with-angularjs-sandbox-escape-and-csp/엄격한 CSP가 적용된 AngularJS 1.4.4 환경에서 ng-focus와 orderBy 표현식 가젯으로 샌드박스를 탈출하는 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-with-angularjs-sandbox-escape-without-strings/Sun, 07 Jun 2026 09:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-with-angularjs-sandbox-escape-without-strings/문자열과 $eval을 사용할 수 없는 AngularJS 1.4.4 환경에서 String 프로토타입과 orderBy 필터로 샌드박스를 탈출하는 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---exploiting-xss-to-bypass-csrf-defenses/Sat, 06 Jun 2026 18:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---exploiting-xss-to-bypass-csrf-defenses/Stored XSS로 피해자의 계정 페이지에서 CSRF 토큰을 읽고 이메일 변경 요청을 전송하는 공격 연계 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---exploiting-cross-site-scripting-to-capture-passwords/Sat, 06 Jun 2026 15:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---exploiting-cross-site-scripting-to-capture-passwords/Stored XSS로 로그인 입력 요소를 삽입해 브라우저의 자동 완성 값을 획득하고 피해자 계정으로 로그인하는 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---exploiting-cross-site-scripting-to-steal-cookies/Sat, 06 Jun 2026 12:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---exploiting-cross-site-scripting-to-steal-cookies/댓글의 Stored XSS를 이용해 피해자의 세션 쿠키를 유출하고 해당 세션으로 사용자를 사칭하는 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-into-a-template-literal-with-angle-brackets-single-double-quotes-backslash-and-backticks-unicode-escaped/Sat, 06 Jun 2026 09:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-into-a-template-literal-with-angle-brackets-single-double-quotes-backslash-and-backticks-unicode-escaped/여러 구분 문자가 인코딩된 JavaScript 템플릿 리터럴에서 ${} 표현식을 이용해 코드를 실행하는 Reflected XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-into-a-javascript-string-with-angle-brackets-and-double-quotes-html-encoded-and-single-quotes-escaped/Fri, 05 Jun 2026 18:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-into-a-javascript-string-with-angle-brackets-and-double-quotes-html-encoded-and-single-quotes-escaped/작은따옴표 앞에 추가되는 역슬래시를 공격자가 입력한 역슬래시로 상쇄해 JavaScript 문자열을 탈출하는 Reflected XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---stored-xss-into-onclick-event-with-angle-brackets-and-double-quotes-html-encoded-and-single-quotes-and-backslash-escaped/Fri, 05 Jun 2026 15:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---stored-xss-into-onclick-event-with-angle-brackets-and-double-quotes-html-encoded-and-single-quotes-and-backslash-escaped/댓글 Website 값이 onclick의 JavaScript 문자열에도 삽입되는 지점에서 HTML 엔티티 디코딩을 이용해 이스케이프를 우회하는 Stored XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-into-a-javascript-string-with-single-quote-and-backslash-escaped/Fri, 05 Jun 2026 12:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-into-a-javascript-string-with-single-quote-and-backslash-escaped/작은따옴표와 역슬래시가 이스케이프되는 JavaScript 문자열에서 HTML 파서의 script 종료 규칙을 이용하는 Reflected XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-in-canonical-link-tag/Fri, 05 Jun 2026 09:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-in-canonical-link-tag/현재 URL이 canonical link의 작은따옴표 속성에 반사되는 지점에 accesskey와 onclick을 주입하는 Reflected XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-with-some-svg-markup-allowed/Thu, 04 Jun 2026 18:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-with-some-svg-markup-allowed/일반적인 태그와 이벤트를 차단하는 WAF에서 허용된 SVG animateTransform 요소와 onbegin 이벤트를 찾는 Reflected XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-into-html-context-with-all-tags-blocked-except-custom-ones/Thu, 04 Jun 2026 15:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-into-html-context-with-all-tags-blocked-except-custom-ones/표준 HTML 태그가 모두 차단된 환경에서 포커스 가능한 커스텀 요소와 URL fragment를 이용하는 Reflected XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-into-html-context-with-most-tags-and-attributes-blocked/Thu, 04 Jun 2026 12:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-into-html-context-with-most-tags-and-attributes-blocked/WAF가 허용하는 body 태그와 onresize 이벤트를 열거하고 iframe 크기 변경으로 자동 실행하는 Reflected XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---stored-dom-xss/Thu, 04 Jun 2026 09:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---stored-dom-xss/댓글 데이터를 innerHTML에 삽입하기 전 replace로 첫 꺾쇠만 치환하는 불완전한 이스케이프를 우회하는 Stored DOM XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-dom-xss/Wed, 03 Jun 2026 18:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-dom-xss/서버가 JSON에 반사한 검색어를 클라이언트가 eval로 처리하는 흐름에서 역슬래시 이스케이프 누락을 이용하는 Reflected DOM XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---dom-xss-in-angularjs-expression-with-angle-brackets-and-double-quotes-html-encoded/Wed, 03 Jun 2026 15:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---dom-xss-in-angularjs-expression-with-angle-brackets-and-double-quotes-html-encoded/HTML 인코딩된 검색어가 ng-app 범위에 삽입되는 환경에서 AngularJS 표현식과 Function 생성자로 alert를 실행하는 DOM XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---dom-xss-in-document.write-sink-using-source-location.search-inside-a-select-element/Wed, 03 Jun 2026 12:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---dom-xss-in-document.write-sink-using-source-location.search-inside-a-select-element/storeId 파라미터가 document.write를 통해 select 내부 option으로 삽입되는 컨텍스트를 탈출하는 DOM XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-into-a-javascript-string-with-angle-brackets-html-encoded/Wed, 03 Jun 2026 09:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-into-a-javascript-string-with-angle-brackets-html-encoded/꺾쇠가 인코딩되지만 입력값이 JavaScript 문자열에 반사되는 환경에서 작은따옴표로 문자열을 탈출하는 Reflected XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---stored-xss-into-anchor-href-attribute-with-double-quotes-html-encoded/Tue, 02 Jun 2026 18:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---stored-xss-into-anchor-href-attribute-with-double-quotes-html-encoded/댓글의 Website 값이 작성자 링크 href에 저장되는 지점에 javascript URL을 삽입하는 Stored XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-into-attribute-with-angle-brackets-html-encoded/Tue, 02 Jun 2026 15:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-into-attribute-with-angle-brackets-html-encoded/꺾쇠가 HTML 인코딩되는 환경에서 input의 value 속성을 탈출하고 autofocus와 onfocus를 주입하는 Reflected XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---dom-xss-in-jquery-selector-sink-using-a-hashchange-event/Tue, 02 Jun 2026 12:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---dom-xss-in-jquery-selector-sink-using-a-hashchange-event/location.hash가 jQuery 선택자에 전달되는 DOM XSS를 iframe의 hashchange 이벤트로 자동 트리거하는 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---dom-xss-in-jquery-anchor-href-attribute-sink-using-location.search-source/Tue, 02 Jun 2026 09:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---dom-xss-in-jquery-anchor-href-attribute-sink-using-location.search-source/returnPath 파라미터가 jQuery attr 함수로 링크의 href에 대입되는 흐름에서 javascript URL을 주입하는 DOM XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---dom-xss-in-innerhtml-sink-using-source-location.search/Mon, 01 Jun 2026 18:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---dom-xss-in-innerhtml-sink-using-source-location.search/검색어가 location.search에서 innerHTML sink로 전달되는 흐름에서 img의 onerror 이벤트를 이용해 스크립트를 실행하는 DOM XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---dom-xss-in-document.write-sink-using-source-location.search/Mon, 01 Jun 2026 15:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---dom-xss-in-document.write-sink-using-source-location.search/location.search에서 가져온 검색어가 document.write로 img 속성에 삽입되는 흐름을 이용해 이벤트 핸들러를 주입하는 DOM XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---stored-xss-into-html-context-with-nothing-encoded/Mon, 01 Jun 2026 12:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---stored-xss-into-html-context-with-nothing-encoded/댓글 본문에 저장된 script 태그가 게시글을 조회하는 사용자의 브라우저에서 실행되는 기본 Stored XSS 풀이https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-into-html-context-with-nothing-encoded/Mon, 01 Jun 2026 09:00:00 +0900https://blog.mingon.dev/write-up/portswigger/xss/write-up-portswigger---reflected-xss-into-html-context-with-nothing-encoded/검색어가 인코딩 없이 HTML 본문에 반사되는 지점에 script 태그를 삽입해 JavaScript를 실행하는 기본 Reflected XSS 풀이