Track reflection. Map filters. Chain what pays.

0:00–0:15 Contexts cold: HTML / attribute / JS / URL

Write 4 contexts + breakout char per context. Read PortSwigger XSS topic § contexts ONLY + cheat-sheet § probe set (test strings, not payloads) ONLY + WSTG reflected XSS § objectives ONLY.

0:15–1:05 Unique-tag tracking + filter map before payload (lab)

Inject <u>u7t123 per param (NahamSec method), locate in DevTools (HTML/attr/JS). Map filter: stripped vs encoded vs executed. Do THM xss Task 3 (reflected) + Task 7 (payload L1–L6 perfecting) ONLY + PortSwigger Lab: Reflected XSS into HTML context with nothing encoded (first reflected lab, context order) ONLY. Chrome-test every candidate.

1:05–2:00 Filter-evasion + WAF-bypass cases (read the bypass, not the payload)

Read THM axss Task 4 (reflected Nay-server) — filter logic ONLY + H1/Intigriti 1 filter-evasion + 1 WAF-bypass (search xss lang:en min_faves:50 bug bounty) — bypassed rule ONLY + HackTricks XSS § filter-bypass table ONLY.

2:00–2:35 dalfox gated pipe (lab) + OWASP prevention quote

cat urls.txt | dalfox scan --silence --json on LAB ONLY, --waf-min-confidence 0.7. Read OWASP XSS Prevention sheet § output-encoding contexts ONLY (for remediation quotes). Never point dalfox at live unscoped.

2:35–3:00 Filter vs encode test + gaps

Explain difference + show Chrome-tested proof. Triage gaps (stored/DOM next).

0:00–0:15 Stored vs reflected vs blind (where each executes)

Diagram execution points (self vs other user vs admin panel vs OOB inbox). Read WSTG stored XSS § objectives ONLY.

0:15–1:05 Stored labs: profile/comment → admin view + blind dual-payload

Do PortSwigger Lab: Stored XSS into HTML context with nothing encoded (profile/comment → second view) + THM xss Task 4 (stored) + Task 6/8 (blind + practical) ONLY. Fire alert(1) + blind <script src=//CB> dual (lab). Poll interactsh-client -oob -correlate / Collaborator. Extra free reps: Hacker101 CTF — do the XSS flags ONLY (https://ctf.hacker101.com/, free, same class).

1:05–2:00 Stored admin-ATO + S3-takeover→JS-inject chains

Read H1 #1598347 (deleted S3 vspcode → page_widget JS inject → login-form replace + history.pushState harvest) FULL chain + H1 #1028332 (stored via 3rd-party CNAME) — sink ONLY. Extract handoff: inject → harvest → ATO.

2:00–2:35 Stored-input inventory (who views, with what privilege)

List inputs (profile, comments, tickets, uploads/SVG) × viewer (self/support/admin) × privilege. Note SVG-upload vector for Week 09.

2:35–3:00 Stored>reflected test + gaps

Argue with 2 reasons + callback proof. Triage gaps (DOM next).

0:00–0:15 Sources/sinks + postMessage origin rule

List location.hash/search → innerHTML/document.write/eval + postMessage(*). Read PortSwigger DOM topic § sources/sinks ONLY + HackTricks postMessage § origin check ONLY.

0:15–1:05 DOM labs: source→sink trace + postMessage + clobber (lab)

Do PortSwigger DOM labs (trace in DevTools Sources) + THM domattacks (hash→innerHTML, clobber) + THM xss Task 5 (DOM) ONLY. Test origin check + id→window clobber hijack (lab).

1:05–2:00 DOM-clobber→XSS + CSP-bypass + sanitizer cases

Read 1 DOM-clobber→XSS (search postMessage XSS bounty) + 1 CSP-bypass (allowlist/nonce/strict-dynamic gap) + Google Closure sanitizer bypass summary — bypassed rule ONLY each.

2:00–2:35 Source-sink map + CSP weakness notes

Map your lab target + note CSP script-src gaps (unsafe-inline, allowlisted CDN, nonce reuse).

2:35–3:00 Sink-example test + gaps

Trace one sink end-to-end aloud. Triage gaps (CSRF next).

0:00–0:15 Preconditions: cookies + state-changing GET/POST

State CSRF needs (cookie auth + no token + state change). Read PortSwigger CSRF topic § token/method/SameSite ONLY + WSTG CSRF § objectives ONLY.

0:15–1:05 CSRF labs: token omission + method override + mirrored cookie

Do PortSwigger Lab: CSRF with no defenses (build the HTML PoC first — the baseline every bypass lab mutates) + THM csrfV2 Task 2–5 (form/fetch, Lax/None bypass, token weakness) ONLY. Build 1 HTML PoC (lab) + test SameSite=Lax top-level-GET gap.

1:05–2:00 Login-CSRF + CSRF→ATO chain (when it pays)

Read H1 login-CSRF resolved report — session-fixation handoff ONLY + 1 CSRF→ATO (email-change → takeover) — chained action ONLY. Filter: password/email/2FA-disable = pay; preference-toggle = N/A.

2:00–2:35 Sensitive-action inventory for your target class

List actions (email/pass/2FA/API-key/payout) × method × token presence. Kill the rest in kill-log.

2:35–3:00 Pay-vs-N/A test + gaps

Judge 3 endpoints pay/N/A with reasons. Triage gaps (CORS next).

0:00–0:15 Danger combos: reflect+creds, null vs wildcard

Write combos, then read PortSwigger CORS § reflection + ACAC + null/wildcard ONLY + HackTricks CORS-bypass § trusted-subdomain row ONLY.

0:15–1:05 Origin matrix incl. null (lab)

Do PortSwigger Lab: Basic origin reflection attack (send Origin: https://evil.com, read ACAO/ACAC — the template every other CORS lab mutates) + THM corsandsop (reflection, preflight, null, cred-theft) ONLY. Matrix columns: origin sent → ACAO/ACAC returned → creds? → verdict.

1:05–2:00 Kettle bitcoins + Rockstar/Zomato cred-theft

Read Kettle CORS bitcoins research § creds:true theft flow ONLY + H1 #317391 Rockstar + #426165 Zomato — ACAO reflection + withCredentials PoC ONLY. Build 1 fetch(url,{credentials:'include'}) PoC (lab).

2:00–2:35 Regex/substring/HTTP-downgrade + subdomain-chain note

Test eviltarget.com, target.evil.com, http://target variants (lab). Note which trusted subdomain you would claim (theory).

2:35–3:00 Null-origin risk test + gaps

Explain sandboxed-iframe null risk + creds rule. Triage gaps.

0:00–0:15 XFO vs frame-ancestors + HTML-injection line

State header values (DENY/SAMEORIGIN vs frame-ancestors 'none'/'self'). Read PortSwigger clickjacking § defenses ONLY + WSTG clickjacking § objectives ONLY. Line: HTML injection (no JS) → escalate to XSS only if JS executes.

0:15–1:05 Clickjacking labs: framing + bypass + chain draft

Do PortSwigger clickjacking labs — start with the basic framing lab, then the bypass variant (filter: All labs → Clickjacking, Apprentice → Practitioner order) ONLY. Draft chain: framing + drag-drop/likejack/cursorjack → CSRF action (lab). Test XFO: ALLOW-FROM + nested-iframe bypasses.

1:05–2:00 Clickjack→CSRF + HTML-injection phish cases

Read 1 clickjack→CSRF chain + 1 HTML-injection form-harvest (payment page) — chained action ONLY. Severity: sensitive action + framing + no defense.

2:00–2:35 UI-redress triage: frame tests + severity gate

Gate: framable? sensitive? defense absent? chainable? Kill decorative-only framing.

2:35–3:00 XFO vs ancestors test + gaps

Recite + show header diff. Triage gaps (live hunt next).

0:00–0:15 Week checklist recall (5 classes + kill rules)

List XSS/DOM/CSRF/CORS/clickjack + kill rules (self-XSS, no-creds CORS, decorative framing). Check WSTG checklist client-side rows ONLY.

0:15–1:05 Full client-surface crawl + JS re-check on VDP (gentle)

Crawl inputs/sinks + re-run Day-5 JS triage on 2 pages. dalfox OFF on live (manual only). Blind payloads to YOUR Collaborator only, lab + 1 VDP input max. Reference HuntBook client-surface procedure headings ONLY.

1:05–2:00 Same-target disclosed client reports (2)

Read H1 hacktivity same-program (XSS/CORS) 2 — sink + defense-gap ONLY. Compare your coverage gaps.

2:00–2:35 XSS playbook update + kill log (triage gate enforced)

Update playbook (contexts/filters/bypasses that worked). Kill self-XSS/no-impact with reasons. No spam payloads on live — smallest PoC only.

2:35–3:00 Triage-gate test + gaps to Week 06

Recite gate. Assign gaps (injection sinks → Week 06). Archive PoCs (redacted).