Source code for Hacker101.com - a free online web and mobile security class.

DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:

Most advanced XSS scanner.

A list of resources for those interested in getting started in bug bounties

一款完善的安全评估工具，支持常见 web 安全问题扫描和自定义 poc | 使用之前务必先阅读文档

一款足够简单、足够好用、足够强的免费 WAF。基于业界领先的语义引擎检测技术，作为反向代理接入，保护你的网站不受黑客攻击。 A free WAF that is sufficiently simple, effective, and powerful. Utilizing industry-leading semantic engine detection technology, it operates as a reverse proxy to protect your website from hacker attacks.

🎯 Cross Site Scripting ( XSS ) Vulnerability Payload List

lamp-cloud 基于Jdk11 + SpringCloud + SpringBoot 开发的微服务中后台快速开发平台，专注于多租户(SaaS架构)解决方案，亦可作为普通项目（非SaaS架构）的基础开发框架使用，目前已实现插拔式数据库隔离、SCHEMA隔离、字段隔离 等租户隔离方案。

Awesome XSS stuff

Web-Security-Learning

Web Application Security Scanner Framework

Git All the Payloads! A collection of web attack payloads.

🌙🦊 Dalfox is a powerful open-source XSS scanner and utility focused on automation.

Top disclosed reports from HackerOne

bluemonday: a fast golang HTML sanitizer (inspired by the OWASP Java HTML Sanitizer) to scrub user generated content of XSS

🐈Medusa是一个红队武器库平台，目前包括XSS平台、协同平台、CVE监控、免杀生成、DNSLOG、钓鱼邮件、文件获取等功能，持续开发中

XSS'OR - Hack with JavaScript.

Collection of quality safety articles. Awesome articles.

A container repository for my public web hacks!

A collection of tiny XSS Payloads that can be used in different contexts. https://tinyxss.terjanq.me