Scribd
Upload
12 views

Cross Site Scripting XSS

Cross-site scripting (XSS) is a type of attack where malicious scripts are injected into web pages, allowing attackers to hijack user sessions, steal sensitive information, and more. There are three main types of XSS attacks: reflected XSS, stored XSS, and DOM-based XSS. Developers can prevent XSS by validating and sanitizing all user input, properly encoding output, using a content security policy, and following secure coding practices.

Uploaded by

manojboga150
Copyright
© © All Rights Reserved
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
12 views

Cross Site Scripting XSS

Cross-site scripting (XSS) is a type of attack where malicious scripts are injected into web pages, allowing attackers to hijack user sessions, steal sensitive information, and more. There are three main types of XSS attacks: reflected XSS, stored XSS, and DOM-based XSS. Developers can prevent XSS by validating and sanitizing all user input, properly encoding output, using a content security policy, and following secure coding practices.

Uploaded by

manojboga150
Copyright
© © All Rights Reserved
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
You are on page 1/ 11

Cross-Site Scripting

(XSS)
Presented by:

MANOJ BOGA
Understanding Cross-
Site Scripting (XSS)
Cross-Site Scripting (XSS) is a type of cyber attack where malicious scripts are
injected into web pages, allowing attackers to hijack user sessions, steal sensitive
information, and more. It's a critical vulnerability that every web developer
should understand and mitigate.
How XSS Works
1 Injection
The attacker injects malicious code, typically JavaScript, into a web page or
application.

2 Execution
When the page loads, the malicious script executes, giving the attacker control over
the user's session and data.

3 Exploitation
The attacker can then steal sensitive information, hijack user accounts, or perform
other malicious actions.
Types of XSS Attacks
1 Reflected XSS 2 Stored XSS 3 DOM-based XSS
Where the malicious script Where the malicious script Where the vulnerability
is reflected back to the user is permanently stored on exists in the client-side
through the vulnerable web the server and executed by JavaScript code that
application. every user who views the processes user input.
page.
Identifying XSS Vulnerabilities
Input Validation Output Encoding Code Auditing

Carefully validate and sanitize Properly encode and escape all Regularly audit your codebase to
all user input to prevent the output to prevent the execution identify and fix any potential
injection of malicious scripts. of injected scripts. XSS vulnerabilities.
Preventing XSS Attacks
Input Validation Output Encoding
Validate and sanitize all user input using input Properly encode and escape all output to prevent
validation libraries and techniques. the execution of injected scripts.

Content Security Policy Secure Coding Practices


Use a Content Security Policy (CSP) to restrict the Implement secure coding practices, such as using
sources from which resources can be loaded. parameterized queries and avoiding dynamic
JavaScript generation.
Mitigating XSS Attacks

Web Application Content Security Input Validation Security


Firewall Policy Awareness
Validate and sanitize all
Use a WAF to detect Implement a CSP to user input to prevent the Train developers and
and block XSS attacks restrict the sources of injection of malicious users on the risks of
in real-time. scripts and other scripts. XSS and how to identify
resources. and prevent it.
Real-World XSS Examples
Yahoo! Mail XSS
In 2013, a vulnerability in Yahoo! Mail allowed attackers to steal user data and hijack
accounts.

GitHub XSS
In 2018, an XSS vulnerability in GitHub's Gist feature allowed attackers to steal user
data.

Facebook XSS
In 2019, a critical XSS flaw in Facebook's search functionality allowed attackers to
steal user data.
Importance of XSS Security
Data Theft XSS attacks can be used to steal sensitive user data,
such as login credentials, financial information, and
personal details.

Account Hijacking Attackers can hijack user sessions and take control
of their accounts, allowing them to perform
unauthorized actions.

Malware Delivery XSS vulnerabilities can be exploited to deliver


malware to users, compromising their devices and
networks.

Reputation Damage Successful XSS attacks can severely damage an


organization's reputation and erode user trust.
LAB
<img src=1 href=1 onerror="javascript:alert(thankyou)"></img>

You might also like