Web Security

Question 1

What is Cross-Site Scripting (XSS) and how does it work?
(5)

What is a subtype of XSS?

Answer 1

XSS is a code injection attack that allows attacker to execute malicious JavaScript in another user’s browser.
Attacker doesn’t directly target victim.
Attacker exploits vulnerability in a website that the victim visits.
Website will deliver the malicious JavaScript.
Malicious JavaScript appears to be a legit part of the website.
Can use SQL injection to insert malicious JavaScript code.

Subtype: Self-XSS. Using social engineering, trick users to execute malicious JavaScript to their browser.

Question 2

Name three consequences of Cross-Site Scripting attacks.

Answer 2

1. Cookie theft
2. Key logging, using addEventListener
3. Phishing, inserting a fake login form into the page using DOM manipulation

Question 3

What are two methods of preventing XSS?

Answer 3

1. Encoding = escapes the user input so that the browser only interprets it as data, not as code.
2. Validation = filters the user input so that the browser only interprets it as code without malicious commands.