XSS Reorganization #1074

manindar-mohan · 2023-06-30T09:42:12Z

This PR fixes #591.

This PR handles the issue and requires no additional PRs.
You have validated the need for this change.

What did this PR accomplish?

Moved all XSS to chapter 11, client-side testing
added sub-sections for XSS

Thank you for your contribution!

…ction for XSS and then going into more tests for other types of testing.

…ameter_Pollution (OWASP#591)

…Testing/03.2-Testing_for_MySQL (OWASP#591)

…Testing/06-Testing_for_SSI_Injection (OWASP#591)

…Testing/08-Testing_for_IMAP_SMTP_Injection (OWASP#591)

…Testing/09.1-Testing_for_File_Inclusion (OWASP#591)

…Testing/10-Testing_for_Command_Injection (OWASP#591)

…Testing/12-Testing_for_Format_String_Injection (OWASP#591)

…Testing/13-Testing_for_Incubated_Vulnerability (OWASP#591)

…Testing/14-Testing_for_HTTP_Splitting_Smuggling (OWASP#591)

…alidation_Testing/16-Testing_for_Host_Header_Injection (OWASP#591)

…lidation_Testing/17-Testing_for_Server-side_Template_Injection (OWASP#591)

…lidation_Testing/18-Testing_for_Server-Side_Request_Forgery (OWASP#591)

…Testing/19-Testing_for_Mass_Assignment (OWASP#591)

…se study link old one is not available anymore

github-actions · 2023-07-03T12:45:59Z

The following links are broken:
FILE:document/4-Web_Application_Security_Testing/07-Input_Validation_Testing/03.3-Testing_for_SQL_Server.md
[✖] ../../6-Appendix/C-Fuzz_Vectors.md → Status: 400

manindar-mohan · 2023-07-03T12:51:44Z

I have fixed almost all the mistakes, yet some are popping up on adjacent pushes, should I fix them all? these mistakes are from the old files that I haven’t changed. @kingthorin

kingthorin · 2023-07-03T13:08:10Z

I’ll have a look shortly. It’s probably fine.

ThunderSon · 2023-07-08T16:35:58Z

...plication_Security_Testing/07-Input_Validation_Testing/01-Testing_for_HTTP_Verb_Tampering.md

@@ -2,6 +2,6 @@

 |ID |
 |------------|
-|WSTG-INPV-03|
+|WSTG-INPV-01|


@kingthorin I wouldn't put this as Id number 1. I feel with v5, we can take it out, no?
This will impact all the other docs, so I think we need to decide on this.

You mean this specific topic?

...ecurity_Testing/07-Input_Validation_Testing/17-Testing_for_Server-side_Template_Injection.md

ThunderSon · 2023-07-08T16:42:29Z

...n_Security_Testing/11-Client-side_Testing/01.3-Testing_for_DOM-based_Cross_Site_Scripting.md

-|ID |
-|------------|
-|WSTG-CLNT-01|
+## References


References must be at the end of the document, not at the start. Any reason for moving them here?

github-actions · 2023-07-11T07:29:29Z

The following links are broken:
FILE:document/4-Web_Application_Security_Testing/04-Authentication_Testing/07-Testing_for_Weak_Security_Question_Answer.md
[✖] 09-Testing_for_Weak_Password_Change_or_Reset_Functionalities.md → Status: 400
[✖] 03-Testing_for_Weak_Lock_Out_Mechanism.md → Status: 400

github-actions · 2023-07-11T07:29:46Z

The following mistakes were identified:

/home/runner/work/wstg/wstg/document/4-Web_Application_Security_Testing/04-Authentication_Testing/03-Testing_for_Bypassing_Authentication_Schema.md
15:108 ✖ Incorrect usage of the term: “life cycle”, use “lifecycle” instead terminology
97:256 ✖ Incorrect usage of the term: “back end”, use “backend” instead terminology

/home/runner/work/wstg/wstg/document/4-Web_Application_Security_Testing/04-Authentication_Testing/07-Testing_for_Weak_Security_Question_Answer.md
12:253 ✖ Incorrect usage of the term: “websites”, use “sites” instead terminology

/home/runner/work/wstg/wstg/document/4-Web_Application_Security_Testing/04-Authentication_Testing/08-Testing_for_Weak_Password_Change_or_Reset_Functionalities.md
9:277 ✖ Incorrect usage of the term: “website”, use “site” instead terminology
150:215 ✖ Incorrect usage of the term: “website”, use “site” instead terminology

/home/runner/work/wstg/wstg/document/4-Web_Application_Security_Testing/04-Authentication_Testing/09-Testing_for_Weaker_Authentication_in_Alternative_Channel.md
13:12 ✖ Incorrect usage of the term: “website”, use “site” instead terminology
14:41 ✖ Incorrect usage of the term: “website”, use “site” instead terminology
15:27 ✖ Incorrect usage of the term: “website”, use “site” instead terminology
16:36 ✖ Incorrect usage of the term: “websites”, use “sites” instead terminology
17:12 ✖ Incorrect usage of the term: “websites”, use “sites” instead terminology
17:71 ✖ Incorrect usage of the term: “website”, use “site” instead terminology
17:147 ✖ Incorrect usage of the term: “website”, use “site” instead terminology
18:63 ✖ Incorrect usage of the term: “website”, use “site” instead terminology
27:152 ✖ Incorrect usage of the term: “website”, use “site” instead terminology
38:13 ✖ Incorrect usage of the term: “website”, use “site” instead terminology
40:38 ✖ Incorrect usage of the term: “website”, use “site” instead terminology
58:121 ✖ Incorrect usage of the term: “android”, use “Android” instead terminology
59:40 ✖ Incorrect usage of the term: “websites”, use “sites” instead terminology
67:48 ✖ Incorrect usage of the term: “Website”, use “site” instead terminology
81:249 ✖ Incorrect usage of the term: “host name”, use “hostname” instead terminology

/home/runner/work/wstg/wstg/document/4-Web_Application_Security_Testing/04-Authentication_Testing/10-Testing_Multi-Factor_Authentication.md
162:90 ✖ Incorrect usage of the term: “website”, use “site” instead terminology

…n_Testing/17-Testing_for_Server-side_Template_Injection.md Co-authored-by: ThunderSon <[email protected]>

github-actions · 2023-07-24T12:40:49Z

The following links are broken:
FILE:document/4-Web_Application_Security_Testing/04-Authentication_Testing/07-Testing_for_Weak_Security_Question_Answer.md
[✖] 09-Testing_for_Weak_Password_Change_or_Reset_Functionalities.md → Status: 400
[✖] 03-Testing_for_Weak_Lock_Out_Mechanism.md → Status: 400

github-actions · 2023-07-24T12:41:10Z

The following mistakes were identified:

/home/runner/work/wstg/wstg/document/4-Web_Application_Security_Testing/04-Authentication_Testing/03-Testing_for_Bypassing_Authentication_Schema.md
15:108 ✖ Incorrect usage of the term: “life cycle”, use “lifecycle” instead terminology
97:256 ✖ Incorrect usage of the term: “back end”, use “backend” instead terminology

/home/runner/work/wstg/wstg/document/4-Web_Application_Security_Testing/04-Authentication_Testing/07-Testing_for_Weak_Security_Question_Answer.md
12:253 ✖ Incorrect usage of the term: “websites”, use “sites” instead terminology

/home/runner/work/wstg/wstg/document/4-Web_Application_Security_Testing/04-Authentication_Testing/08-Testing_for_Weak_Password_Change_or_Reset_Functionalities.md
9:277 ✖ Incorrect usage of the term: “website”, use “site” instead terminology
150:215 ✖ Incorrect usage of the term: “website”, use “site” instead terminology

/home/runner/work/wstg/wstg/document/4-Web_Application_Security_Testing/04-Authentication_Testing/09-Testing_for_Weaker_Authentication_in_Alternative_Channel.md
13:12 ✖ Incorrect usage of the term: “website”, use “site” instead terminology
14:41 ✖ Incorrect usage of the term: “website”, use “site” instead terminology
15:27 ✖ Incorrect usage of the term: “website”, use “site” instead terminology
16:36 ✖ Incorrect usage of the term: “websites”, use “sites” instead terminology
17:12 ✖ Incorrect usage of the term: “websites”, use “sites” instead terminology
17:71 ✖ Incorrect usage of the term: “website”, use “site” instead terminology
17:147 ✖ Incorrect usage of the term: “website”, use “site” instead terminology
18:63 ✖ Incorrect usage of the term: “website”, use “site” instead terminology
27:152 ✖ Incorrect usage of the term: “website”, use “site” instead terminology
38:13 ✖ Incorrect usage of the term: “website”, use “site” instead terminology
40:38 ✖ Incorrect usage of the term: “website”, use “site” instead terminology
58:121 ✖ Incorrect usage of the term: “android”, use “Android” instead terminology
59:40 ✖ Incorrect usage of the term: “websites”, use “sites” instead terminology
67:48 ✖ Incorrect usage of the term: “Website”, use “site” instead terminology
81:249 ✖ Incorrect usage of the term: “host name”, use “hostname” instead terminology

/home/runner/work/wstg/wstg/document/4-Web_Application_Security_Testing/04-Authentication_Testing/10-Testing_Multi-Factor_Authentication.md
162:90 ✖ Incorrect usage of the term: “website”, use “site” instead terminology

kingthorin · 2023-07-24T12:52:05Z

Why did you close this?

manindar-mohan · 2023-07-25T07:02:30Z

Sorry, that was a mistake, didn’t know this happened.

github-actions · 2023-07-25T10:02:25Z

The following links are broken:
FILE:document/4-Web_Application_Security_Testing/04-Authentication_Testing/07-Testing_for_Weak_Security_Question_Answer.md
[✖] 09-Testing_for_Weak_Password_Change_or_Reset_Functionalities.md → Status: 400
[✖] 03-Testing_for_Weak_Lock_Out_Mechanism.md → Status: 400

github-actions · 2023-07-25T10:02:36Z

The following mistakes were identified:

/home/runner/work/wstg/wstg/document/4-Web_Application_Security_Testing/04-Authentication_Testing/03-Testing_for_Bypassing_Authentication_Schema.md
15:108 ✖ Incorrect usage of the term: “life cycle”, use “lifecycle” instead terminology
97:256 ✖ Incorrect usage of the term: “back end”, use “backend” instead terminology

/home/runner/work/wstg/wstg/document/4-Web_Application_Security_Testing/04-Authentication_Testing/07-Testing_for_Weak_Security_Question_Answer.md
12:253 ✖ Incorrect usage of the term: “websites”, use “sites” instead terminology

/home/runner/work/wstg/wstg/document/4-Web_Application_Security_Testing/04-Authentication_Testing/08-Testing_for_Weak_Password_Change_or_Reset_Functionalities.md
9:277 ✖ Incorrect usage of the term: “website”, use “site” instead terminology
150:215 ✖ Incorrect usage of the term: “website”, use “site” instead terminology

/home/runner/work/wstg/wstg/document/4-Web_Application_Security_Testing/04-Authentication_Testing/09-Testing_for_Weaker_Authentication_in_Alternative_Channel.md
13:12 ✖ Incorrect usage of the term: “website”, use “site” instead terminology
14:41 ✖ Incorrect usage of the term: “website”, use “site” instead terminology
15:27 ✖ Incorrect usage of the term: “website”, use “site” instead terminology
16:36 ✖ Incorrect usage of the term: “websites”, use “sites” instead terminology
17:12 ✖ Incorrect usage of the term: “websites”, use “sites” instead terminology
17:71 ✖ Incorrect usage of the term: “website”, use “site” instead terminology
17:147 ✖ Incorrect usage of the term: “website”, use “site” instead terminology
18:63 ✖ Incorrect usage of the term: “website”, use “site” instead terminology
27:152 ✖ Incorrect usage of the term: “website”, use “site” instead terminology
38:13 ✖ Incorrect usage of the term: “website”, use “site” instead terminology
40:38 ✖ Incorrect usage of the term: “website”, use “site” instead terminology
58:121 ✖ Incorrect usage of the term: “android”, use “Android” instead terminology
59:40 ✖ Incorrect usage of the term: “websites”, use “sites” instead terminology
67:48 ✖ Incorrect usage of the term: “Website”, use “site” instead terminology
81:249 ✖ Incorrect usage of the term: “host name”, use “hostname” instead terminology

/home/runner/work/wstg/wstg/document/4-Web_Application_Security_Testing/04-Authentication_Testing/10-Testing_Multi-Factor_Authentication.md
162:90 ✖ Incorrect usage of the term: “website”, use “site” instead terminology

manindar-mohan and others added 6 commits July 3, 2022 12:56

insecure configuration of CSP when using the unsafe-hashes directive

4434ff6

Merge branch 'OWASP:master' into master

a3951cb

conflict resolved

ee398e2

Merge branch 'OWASP:master' into master

09555cd

Merge branch 'OWASP:master' into master

93db96a

Moved all XSS to chapter 11, client-side testing, and have one big se…

17f7b86

…ction for XSS and then going into more tests for other types of testing.

This comment was marked as outdated.

Sign in to view

manindar-mohan and others added 2 commits June 30, 2023 15:16

Merge branch 'OWASP:master' into master

d05dcaa

mistakes fixed

3188789

This comment was marked as outdated.

Sign in to view

Manindar Mohan added 15 commits June 30, 2023 15:44

mistake fixed for 07-Input_Validation_Testing/02-Testing_for_HTTP_Par…

8304381

…ameter_Pollution (OWASP#591)

mistake fixed for 07-Input_Validation_Testing/02-Testing_for_HTTP_Par…

c5277d4

…ameter_Pollution (OWASP#591)

Mistake fixed 4-Web_Application_Security_Testing/07-Input_Validation_…

b96069f

…Testing/03.2-Testing_for_MySQL (OWASP#591)

Mistake fixed 4-Web_Application_Security_Testing/07-Input_Validation_…

4e19ca5

…Testing/06-Testing_for_SSI_Injection (OWASP#591)

Mistake fixed 4-Web_Application_Security_Testing/07-Input_Validation_…

6de5b1f

…Testing/06-Testing_for_SSI_Injection (OWASP#591)

mistake fixed 4-Web_Application_Security_Testing/07-Input_Validation_…

abd0d14

…Testing/08-Testing_for_IMAP_SMTP_Injection (OWASP#591)

mistake fixed 4-Web_Application_Security_Testing/07-Input_Validation_…

13af516

…Testing/09.1-Testing_for_File_Inclusion (OWASP#591)

mistake fixed 4-Web_Application_Security_Testing/07-Input_Validation_…

ca63381

…Testing/10-Testing_for_Command_Injection (OWASP#591)

mistake fixed 4-Web_Application_Security_Testing/07-Input_Validation_…

796ff39

…Testing/12-Testing_for_Format_String_Injection (OWASP#591)

mistake fixed 4-Web_Application_Security_Testing/07-Input_Validation_…

6f4e77f

…Testing/13-Testing_for_Incubated_Vulnerability (OWASP#591)

Mistake fixed 4-Web_Application_Security_Testing/07-Input_Validation_…

57577bb

…Testing/14-Testing_for_HTTP_Splitting_Smuggling (OWASP#591)

Mistake fixed document/4-Web_Application_Security_Testing/07-Input_V…

3b25297

…alidation_Testing/16-Testing_for_Host_Header_Injection (OWASP#591)

Mistake fixed document/4-Web_Application_Security_Testing/07-Input_Va…

da5a26b

…lidation_Testing/17-Testing_for_Server-side_Template_Injection (OWASP#591)

Mistake fixed document/4-Web_Application_Security_Testing/07-Input_Va…

4f972b8

…lidation_Testing/18-Testing_for_Server-Side_Request_Forgery (OWASP#591)

Mistake fixed 4-Web_Application_Security_Testing/07-Input_Validation_…

407ef1e

…Testing/19-Testing_for_Mass_Assignment (OWASP#591)

This comment was marked as outdated.

Sign in to view

Mistake caused by top level heading fixed

907b73c

This comment was marked as outdated.

Sign in to view

Mistake caused by insuffitent new lines fixed

9ea0801

This comment was marked as outdated.

Sign in to view

This comment was marked as resolved.

Sign in to view

Manindar Mohan added 3 commits July 3, 2023 17:59

Mistake caused by insuffitent new lines fixed

effe070

Mistake caused by broken link fixed

b068749

Mistake caused by Incorrect usage of the term fixed

84536e7

This comment was marked as resolved.

Sign in to view

Mistake caused by roken link for case study is fixed by adding new ca…

cd9010b

…se study link old one is not available anymore

ThunderSon reviewed Jul 8, 2023

View reviewed changes

ThunderSon requested changes Jul 8, 2023

View reviewed changes

ATHN-01 removed and added renamed to new numbers (OWASP#598)

39e23bf

Update document/4-Web_Application_Security_Testing/07-Input_Validatio…

c8dd891

…n_Testing/17-Testing_for_Server-side_Template_Injection.md Co-authored-by: ThunderSon <[email protected]>

manindar-mohan closed this Jul 24, 2023

manindar-mohan deleted the fix-591 branch July 24, 2023 12:45

manindar-mohan restored the fix-591 branch July 25, 2023 07:03

kingthorin reopened this Jul 25, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

XSS Reorganization #1074

XSS Reorganization #1074

manindar-mohan commented Jun 30, 2023 •

edited by kingthorin

This comment was marked as outdated.

This comment was marked as outdated.

This comment was marked as outdated.

This comment was marked as outdated.

This comment was marked as outdated.

This comment was marked as outdated.

This comment was marked as outdated.

This comment was marked as outdated.

This comment was marked as outdated.

This comment was marked as outdated.

This comment was marked as resolved.

This comment was marked as resolved.

github-actions bot commented Jul 3, 2023

manindar-mohan commented Jul 3, 2023

kingthorin commented Jul 3, 2023

ThunderSon Jul 8, 2023

kingthorin Jul 9, 2023

ThunderSon Jul 8, 2023

github-actions bot commented Jul 11, 2023

github-actions bot commented Jul 11, 2023

github-actions bot commented Jul 24, 2023

github-actions bot commented Jul 24, 2023

kingthorin commented Jul 24, 2023

manindar-mohan commented Jul 25, 2023

github-actions bot commented Jul 25, 2023

github-actions bot commented Jul 25, 2023

XSS Reorganization #1074

Are you sure you want to change the base?

XSS Reorganization #1074

Conversation

manindar-mohan commented Jun 30, 2023 • edited by kingthorin

This comment was marked as outdated.

This comment was marked as outdated.

This comment was marked as outdated.

This comment was marked as outdated.

This comment was marked as outdated.

This comment was marked as outdated.

This comment was marked as outdated.

This comment was marked as outdated.

This comment was marked as outdated.

This comment was marked as outdated.

This comment was marked as resolved.

This comment was marked as resolved.

github-actions bot commented Jul 3, 2023

manindar-mohan commented Jul 3, 2023

kingthorin commented Jul 3, 2023

ThunderSon Jul 8, 2023

Choose a reason for hiding this comment

kingthorin Jul 9, 2023

Choose a reason for hiding this comment

ThunderSon Jul 8, 2023

Choose a reason for hiding this comment

github-actions bot commented Jul 11, 2023

github-actions bot commented Jul 11, 2023

github-actions bot commented Jul 24, 2023

github-actions bot commented Jul 24, 2023

kingthorin commented Jul 24, 2023

manindar-mohan commented Jul 25, 2023

github-actions bot commented Jul 25, 2023

github-actions bot commented Jul 25, 2023

manindar-mohan commented Jun 30, 2023 •

edited by kingthorin