Key Concepts

Review core concepts you need to learn to master this subject

Cross-Site Scripting (XSS)

<script>alert(1);</script> <img src="X" onerror=alert(1);> <b onmouseover=alert(1)>click me!</b> <body onload=alert('test1')>

Cross-Site Scripting (XSS) is a vulnerability that occurs when a web application returns unsanitized input to the front end of an application.

Three types of XSS attacks are:

  • Stored XSS: when a server saves an attacker’s input into its datastores.
  • Reflected XSS: when a user’s input is immediately returned back to the user.
  • DOM-Based XSS: when user input is interpreted by the DOM, an attacker could inject arbitrary code.

The code shows examples of HTML tags that help attackers inject dangerous input.

Preventing Cross-Site Scripting (XSS) Attacks
Lesson 1 of 1
  1. 1
    A Cross-Site Scripting (XSS) attack is a type of attack where code is injected into a legitimate and trusted website. There are three main types of XSS Attacks: Stored XSS Attacks: In a Sto…
  2. 2
    In this exercise, we’ll take a closer look at DOM-Based XSS Attacks. A DOM-Based XSS attack occurs when an attack payload is executed by altering the DOM in the victim’s browser. The _DOM (Docu…
  3. 3
    Let’s now explore how Reflected XSS attacks work. In a Reflected XSS Attack, the payload is not stored in a database, it’s reflected onto the site. We saw that, in a DOM-Based attack, the vulne…
  4. 4
    In this exercise, we’ll take a look at how to perform a Stored XSS Attack. When a victim clicks a link, malicious code can send the victim’s cookie to another server or directly modify the affec…
  5. 5
    ### Securing Cookies In the previous exercise, we saw how cookies can be used to steal user’s data. An express server that uses express-session to store cookies has the properties httpOnly and secu…
  6. 6
    In the Reflected and Stored XSS Attacks, we saw how an attacker can inject malicious code into the server and/or database using a form. This is why it’s important to validate and/or sanitize data b…
  7. 7
    We know that, in DOM-Based Attacks, the malicious code is client-side. To prevent this attack developers must be very careful with the type of code used in the browser. To be more specific, these …
  8. 8
    Awesome job! XSS Attacks are still very common and it’s important to be aware of them so you don’t fall victim to one. We’ve looked at what can happen behind the scenes if an attacker successfully …

What you'll create

Portfolio projects that showcase your new skills

Pro Logo

How you'll master it

Stress-test your knowledge with quizzes that help commit syntax to memory

Pro Logo