Vertex

Cross-site scripting (XSS)

XSS is attacker-controlled content executing as script in your page. Contextual output encoding is the fix; blocklists are not.

Lesson 2.118m 32sIntermediate11.2k students

Chapters

18:32
  1. 0:00Intro
  2. 2:40XSS Stored Attacks
  3. 4:50Reflected XSS Attacks
  4. 8:00Source Code Explained
  5. 9:50Prevent XSS Attacks with CSP
  6. 16:00Prevent all scripts with CSP

What this lesson covers

  • Tell stored, reflected, and DOM-based XSS apart
  • Encode output for the context it lands in
  • Constrain script sources with a content security policy

This lesson sits in Common Web Vulnerabilities, part of Practical Web Security. It assumes what came before it and leads directly into the next lesson in the module.

In this lesson you will

  • Tell stored, reflected, and DOM-based XSS apart
  • Encode output for the context it lands in
  • Constrain script sources with a content security policy

Resources

Previous lessonSecure defaults and least privilege1.3 · 4m 56sNext lessonSQL injection2.2 · 4m 14s