From alert(1) to Real-world Impact: Hunting XSS Where Others Don’t Look
1 min read
Summary
Cross Site Scripting (XSS) is one of the most common vulnerabilities which can allow an attacker to inject JavaScript code into a website which will be executed in the victim’s browser.
This can allow the attacker to steal cookies, perform actions on behalf of the user, redirect them to a malicious page, or bypass security controls.
The most common types of XSS are stored XSS, reflected XSS, and DOM-based XSS, but these are not always distinct and new attack surfaces such as Single Page Applications also need to be considered.
To find these kinds of vulnerabilities where others have not looked, it is important to test areas other than just forms, and to use headers, cookies, JSON data, and the shadow DOM to attempt to inject scripts.
Developers can prevent XSS by avoiding certain unsafe APIs, using content security policy (CSP) to block inline scripts, and by validating and sanitising input and output data.