Client Side Testing

Question 1

DOM-Based XSS

Answer 1

The result of active browser-side content on a page, typically JavaScript, obtaining user input and then doing something unsafe with it, leading to the execution of injected code.

Question 2

JavaScript Injection Vulnerability

Answer 2

A subtype of cross site scripting (XSS)

Can occur when the application lacks proper user-supplied input and output validation.

When testing for this vulnerability, consider that some characters are treated differently by different browsers.

Question 3

What are WebSockets?

Answer 3

WebSockets allow the client or server to create a “full-duplex” (two-way) communication channel, allowing the client and server to truly communicate asynchronously.

WebSockets conduct their initial “upgrade” handshake over HTTP and from then on all communication is carried out over TCP channels by use of frames.

Question 4

Using scripts from external sources

Answer 4

If an application uses an external script from an external source, it must be sourced from a trusted CDN (Content Delivery Network) and the Subresource Integrity (SRI) of the script must be verified.

This allows the browser to validate the integrity of the script contents to ensure it has not been manipulated by the external source or another malicious party.