XSS = cross site scripting
https://vulnerable.com/hello?name=
response
Helloxss is when an attacker adds malicious javascript to a legitimate website. the legitimate website will send the attacker’s javascript to browsres, and the attacker’s javascrip will run with the origin of the legitimate website. now the attacker’s javascript can access information on the legitimate website.
stored xss is when the attacker’s javascript is stored on the legitimate server and sent to browser example: facebook pages anybody can load a facebook page with content provided by users an attacker puts some javascript on their facebook page anybody who loads the attacker’s page will see javascript with the origin of facebook
xss defenses: html sanitization idea: certain characters are special, so create sequences that represent these characters as data rather than html
CSP: content security policy idea: instruct the browser to use resources loaded from specific places uses additional headers to specify the policy standard approach: disallow all inline scripts ( javascript code directly in the HTML), which prevents inline XSS example: disallow only allow scripts from specified domains, which prevents xss from linking to external scripts example: disallow