Cross-Site Scripting 2.3

Question 1

[…], otherwise known as XSS, occurs when an attacker sends a victim a link to a legitimate website that contains a malicious script embedded in the URL, which is executed when clicked on.

The malicious script then sends the victims data to the attacker (session cookies, credentials, etc)

Answer 1

Cross-Site Scripting

Question 2

A […] XSS attack allows scripts to be run in user input

Affects only users who click on the link

Ex:
Search Box

Answer 2

Non-persistent (Reflected)

Question 3

A […] attack involves the attacker posting the malicious link to a social media platforms server, which means everyone gets the payload now.

Affects everyone who visits the website

Answer 3

Persistent XSS
(Stored)

Question 4

To protect yourself against XSS attacks, you should:
-[…]
-[…]
-[…]
-[…]

Answer 4

• Be careful when clicking untrusted links
• Consider disabling JavaScript, or limit its capabilities
• Keep browser and applications updated
• Validate input (Don’t allow users to add their own scripts to input fields)