Cross-site scripting (XSS)

XSS is attacker-controlled content executing as script in your page. Contextual output encoding is the fix; blocklists are not.

19m
Intermediate

Video thumbnail for Cross-site scripting (XSS)

Video by Hussein Nasser · YouTube

Check your understanding

3 questions. Unlocks when you finish the video.

Overview

What this lesson covers

Tell stored, reflected, and DOM-based XSS apart
Encode output for the context it lands in
Constrain script sources with a content security policy

This lesson sits in Common Web Vulnerabilities, part of Practical Web Security. It assumes what came before it and leads directly into the next lesson in the module.

In this lesson you will:

Tell stored, reflected, and DOM-based XSS apart
Encode output for the context it lands in
Constrain script sources with a content security policy

Resources

OWASP Top 10The official reference for the tools used in this lesson.