Web Hacking

Burp Suite Cheat Sheet https://www.sans.org/security-resources/posters/burp-suite-cheat-sheet/280/download

Free training on developing Burp Suite extensions https://github.com/doyensec/burpdeveltraining

sri-check | A Burp Suite extension for identifying missing Subresource Integrity attributes. https://github.com/PortSwigger/sri-check

We have another new vector for the XSS cheat sheet! This one requires user interaction and uses the method attribute with the dialog value. <dialog open onclose=alert(1)><form method=dialog><button>XSS</button></form>

Here's an updated polyglot that uses the details tag and now breaks out of template strings too.