Web Hacker Basics 02 (XSS)
iSpeech.org
At its core, Cross Site Scripting is a vulnerability that allows us to modify the source code of a web page. Typically, when an attacker is exploiting a Cross Site vulnerability, their goal is to execute JavaScript, because JavaScript allows them to control everything in a web browser. There are three categories of Cross Site Scripting; Reflected, Stored, and DOM. They all lead to the same kind of code execution, but their attack vectors are different. In this video, we're going to take a look at each of these in a little more detail.
JavaScript refresher:
https://www.w3schools.com/jS/default.asp
Testing for XSS:
https://www.owasp.org/index.php/Testing_for_Reflected_Cross_site_scripting_(OTG-INPVAL-001)
https://www.owasp.org/index.php/Testing_for_Stored_Cross_site_scripting_(OTG-INPVAL-002)
https://www.owasp.org/index.php/Testing_for_DOM-based_Cross_site_scripting_(OWASP-DV-003)
XSS Prevention Cheat Sheet:
https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet
2018-06-29 06:13:16
source
0 Responses to Web Hacker Basics 02 (XSS)