Cross-Site Scripting (XSS)

Cross-Site Scripting (XSS)

What does XSS stand for?

Cross-Site Scripting.

Who is primarily attacked in an XSS exploit?

The end user and their browser.

How does XSS differ from command injection?

XSS runs code in a user's browser; command injection targets server-side execution.

What server-side weakness enables XSS?

Improper input validation or output encoding.

Why can a vulnerable website make attacker content dangerous?

The browser treats the delivered content as part of the trusted site.

Which script language is commonly used for XSS?

JavaScript.

Can XSS inject more than JavaScript?

Yes. Attacker-controlled HTML or CSS can also be involved.

Which MITRE ATT&CK technique does the book associate with XSS?

T1190, Exploit Public-Facing Application.

What is a browser session cookie used for?

Maintaining an authenticated browsing session.

What type of secret can XSS attempt to steal?

An accessible authentication cookie or session token.

Why does malicious JavaScript run in the site's context?

The vulnerable website sends it to the browser as part of its response.

What are the two main XSS types covered in this module?

Stored XSS and reflected XSS.

What is stored XSS?

Malicious content saved by a server and served to later visitors.

Where might a stored XSS payload be saved?

A database, flat file, or other persistent data source.

What user-submitted content could contain stored XSS?

An author biography, username, review, or comment.

Who can become a victim of stored XSS?

Any visitor who opens the affected page.

Does stored XSS require the attacker to target a specific user?

No. It can affect any visitor to the stored-content page.

Why can stored XSS be hard for victims to notice?

The malicious code can execute silently.

What is reflected XSS?

Attacker input immediately returned unsafely in a response and run by the browser.

Which HTTP request method is emphasized in the reflected XSS example?

GET.

What makes an unencoded search term a reflected XSS risk?

The application embeds the term into its response as executable content.

How is reflected XSS commonly delivered to victims?

A crafted link in email, messaging, or a malicious advertisement.

What happens when a victim follows a reflected-XSS link?

The vulnerable site reflects and serves the malicious input to the browser.

Which XSS type is more suited to targeting a chosen person with a link?

Reflected XSS.

What is the key distinction between stored and reflected XSS?

Stored persists on the server; reflected appears in an immediate response.

Why might a trusted domain in a phishing link be misleading?

A trusted site may still reflect malicious script from the URL.

What can XSS do besides show a popup?

Alter content, redirect users, or access browser-session data.

What does a basic alert() test show?

That attacker-supplied JavaScript can execute in the browser.

What is the purpose of the test payload <script>alert('XSS');</script>?

Demonstrate script execution, not the full risk of XSS.

What is document.cookie?

A JavaScript property exposing cookies accessible to the page's scripts.

What is document.location used for in the walkthrough?

Redirecting the browser to another URL.

Why is theft of an authentication token dangerous?

It may allow misuse of an authenticated session.

Which application field is used in the stored XSS walkthrough?

A feedback or comment field.

Who views the stored feedback in the course walkthrough?

A website administrator.

What happens if the administrator opens vulnerable stored feedback?

The embedded JavaScript executes in the administrator's browser.

What does an XSS tester first look for?

User-controlled input that is stored or reflected without safe handling.

What is the role of input filtering in XSS defense?

Reject or restrict dangerous input.

Where must input filtering occur?

On the server side.

What is output encoding?

Converting special characters to safe representations for their output context.

How does HTML encoding help stop XSS?

It prevents special characters from being interpreted as executable markup.

What HTML entity represents an ampersand?

&

Why can manual filtering be unreliable?

An overlooked syntax or context may bypass the filter.

What is preferred over hand-written HTML encoding rules?

Consistently used, trusted encoding and sanitization libraries.

Which Java library for safe output encoding is named?

OWASP Java Encoder Project.

Which PHP sanitization tool is named?

HTML Purifier.

Which Node.js validation library is named?

Joi.

What is a preferred framework security feature?

Built-in input handling and context-appropriate output encoding.

What can a WAF do for an XSS-vulnerable application?

Provide partial mitigation and logging when application code cannot be fixed immediately.

Why is a WAF not a complete XSS fix?

It does not replace secure application-side validation and encoding.

What does the HttpOnly cookie attribute do?

Prevents browser JavaScript from reading that cookie.

Does HttpOnly mean the cookie can only travel over HTTPS?

No. The Secure attribute controls HTTPS-only transmission.

Which cookie attribute restricts transmission to HTTPS?

Secure.

How does HttpOnly limit cookie theft via XSS?

Scripts cannot read protected cookies through document.cookie.

Can adding HttpOnly break some applications?

Yes. Applications needing JavaScript cookie access may be affected.

What does CSP stand for?

Content Security Policy.

What does a CSP response header control?

Which sources a browser may load content from.

What resource categories can CSP restrict?

Scripts, CSS, images, fonts, iframes, and other resources.

Can CSP permit selected third-party resources?

Yes. Allowed resource sources can be specified.

What is CSP report-uri used for in the book?

Reporting browser-detected policy violations to a specified endpoint.

Why does the presence of a CSP header not guarantee protection?

The configured policy may be too permissive or ineffective.

What is important when deploying CSP?

Test that it blocks unwanted sources without breaking legitimate functionality.

What does the command grep in a web log help locate?

Requests matching an attack indicator or pattern.

What is the overall difference between XSS and server compromise?

XSS exploits the browser trust context; it does not itself grant server execution.

What is the key defensive combination for XSS?

Server-side validation, safe output encoding, and defense-in-depth controls.