Preventing Cross-Site Scripting (XSS) Attacks

Learn how Cross-Site Scripting attacks work and how to prevent them.

Start

Key Concepts

Review core concepts you need to learn to master this subject

Cross-Site Scripting (XSS)

Preventing Cross-Site Scripting

Cross-Site-Scripting (XSS)

Cross-Site Scripting (XSS)

<script>alert(1);</script>

<img src="X" onerror=alert(1);>

<b onmouseover=alert(1)>click me!</b>

<body onload=alert('test1')>

Cross-Site Scripting (XSS) is a vulnerability that occurs when a web application returns unsanitized input to the front end of an application.

Three types of XSS attacks are:

Stored XSS: when a server saves an attacker’s input into its datastores.
Reflected XSS: when a user’s input is immediately returned back to the user.
DOM-Based XSS: when user input is interpreted by the DOM, an attacker could inject arbitrary code.

The code shows examples of HTML tags that help attackers inject dangerous input.

Preventing Cross-Site Scripting (XSS) Attacks

Lesson 1 of 1

1
What is a XSS Attack
A Cross-Site Scripting (XSS) attack is a type of attack where code is injected into a legitimate and trusted website. There are three main types of XSS Attacks: Stored XSS Attacks: In a Sto…
Start
2
DOM-Based XSS Attack
In this exercise, we’ll take a closer look at DOM-Based XSS Attacks. A DOM-Based XSS attack occurs when an attack payload is executed by altering the DOM in the victim’s browser. The _DOM (Docu…
Start
3
Reflected XSS Attack
Let’s now explore how Reflected XSS attacks work. In a Reflected XSS Attack, the payload is not stored in a database, it’s reflected onto the site. We saw that, in a DOM-Based attack, the vulne…
Start
4
Stored XSS Attack
In this exercise, we’ll take a look at how to perform a Stored XSS Attack. When a victim clicks a link, malicious code can send the victim’s cookie to another server or directly modify the affec…
Start
5
Securing Cookies and Headers
### Securing Cookies In the previous exercise, we saw how cookies can be used to steal user’s data. An express server that uses express-session to store cookies has the properties httpOnly and secu…
Start
6
Data Validation and Sanitization
In the Reflected and Stored XSS Attacks, we saw how an attacker can inject malicious code into the server and/or database using a form. This is why it’s important to validate and/or sanitize data b…
Start
7
DOM-Based Precautions
We know that, in DOM-Based Attacks, the malicious code is client-side. To prevent this attack developers must be very careful with the type of code used in the browser. To be more specific, these …
Start
8
Review
Awesome job! XSS Attacks are still very common and it’s important to be aware of them so you don’t fall victim to one. We’ve looked at what can happen behind the scenes if an attacker successfully …
Start