Cross-site scripting (XSS) in Cybersecurity - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the primary goal of a Cross-site scripting (XSS) attack?

Choose the option that best describes the main purpose of an XSS attack.

A To gain unauthorized access to a website's backend database directly

B To overload a website's server with excessive traffic causing it to crash

C To inject malicious scripts into trusted websites to steal user data or hijack sessions

D To encrypt user data on a website and demand ransom for decryption

💡 Hint

Think about what happens when attackers insert harmful code into web pages viewed by others.

XSS attacks aim to inject malicious scripts into web pages that other users trust. This allows attackers to steal cookies, session tokens, or perform actions on behalf of users.

📋 Factual

intermediate

Which type of XSS attack occurs when malicious code is permanently stored on the target server?

Select the correct type of XSS attack based on the description.

A Reflected XSS

B Stored XSS

C DOM-based XSS

D Blind XSS

💡 Hint

This type of XSS saves the malicious script in the website's database or message forum.

Stored XSS happens when the malicious script is saved on the server and served to users later, unlike reflected XSS which is temporary.

🔍 Analysis

advanced

What is the main difference between Reflected XSS and DOM-based XSS?

Analyze the following options and select the one that correctly explains the key difference.

A Reflected XSS involves server-side script injection, while DOM-based XSS manipulates client-side scripts without server involvement

B Reflected XSS stores malicious code in the database, DOM-based XSS does not

C DOM-based XSS requires user interaction, Reflected XSS does not

D Reflected XSS only affects mobile browsers, DOM-based XSS affects desktop browsers

💡 Hint

Consider where the malicious script is processed: on the server or in the user's browser.

Reflected XSS involves the server reflecting malicious input back to the user, while DOM-based XSS happens entirely in the browser by manipulating the page's Document Object Model.

🚀 Application

advanced

Which of the following is the most effective way to prevent XSS attacks in web applications?

Select the best practice that helps stop XSS attacks.

A Validating and encoding user input before displaying it on web pages

B Disabling JavaScript entirely on the website

C Using complex passwords for user accounts

D Installing antivirus software on the server

💡 Hint

Think about how user input can be safely handled to avoid running harmful scripts.

Validating and encoding user input ensures that any malicious code is treated as text, not executable code, preventing XSS attacks.

❓ Reasoning

expert

A website uses a search feature that reflects user input in the URL and page content without encoding. Which XSS vulnerability is this, and what is the likely impact?

Identify the XSS type and explain the potential risk to users.

A Blind XSS; attackers inject scripts that never execute visibly but steal data silently

B Stored XSS; attackers permanently save scripts that affect all users visiting the site

C DOM-based XSS; attackers modify the page structure after it loads without server interaction

D Reflected XSS; attackers can trick users into clicking malicious links that execute harmful scripts

💡 Hint

Consider how user input is handled and when the malicious script runs.

When user input is reflected immediately in the page without encoding, it is a Reflected XSS vulnerability. Attackers can craft links that execute scripts when clicked, stealing data or hijacking sessions.

Practice

1. What is the main risk of a Cross-site Scripting (XSS) attack?

easy

A. Attackers physically damage the website server

B. Attackers change the website's design without permission

C. Attackers block access to the website by flooding it with traffic

D. Attackers run harmful scripts on a website to steal user data

Solution

1. Step 1: Understand what XSS does

   XSS allows attackers to inject harmful scripts into websites that run on users' browsers.

2. Step 2: Identify the main risk

   These harmful scripts can steal sensitive user data like passwords or cookies.

3. Final Answer:

   Attackers run harmful scripts on a website to steal user data -> Option D

4. Quick Check:

   XSS risk = harmful scripts stealing data [OK]

Hint: XSS = bad scripts stealing user info on websites [OK]

Common Mistakes:

• Confusing XSS with server damage
• Thinking XSS blocks website access
• Believing XSS changes website design only

2. Which of the following is a correct way to prevent XSS in web code?

easy

A. Allow all user input without filtering

B. Use only images and no text on the website

C. Escape special characters like < and > before displaying user input

D. Disable the website's login page

Solution

1. Step 1: Identify safe coding practice

   Escaping special characters like < and > stops harmful scripts from running as code.

2. Step 2: Check other options

   Allowing all input is unsafe, disabling login or using only images does not prevent XSS.

3. Final Answer:

   Escape special characters like < and > before displaying user input -> Option C

4. Quick Check:

   Escape input = prevent XSS [OK]

Hint: Escape < and > in input to stop scripts [OK]

Common Mistakes:

• Allowing all input without checks
• Thinking disabling login stops XSS
• Believing images-only stops script attacks

3. Consider this HTML snippet showing user input:

<div>User comment: <script>alert('XSS')</script></div>

What will happen if the website does NOT sanitize this input?

medium

A. The alert box with message 'XSS' will appear to the user

B. The script tags will be shown as plain text

C. The website will crash immediately

D. Nothing will happen; input is safe

Solution

1. Step 1: Understand unsanitized script tags

   If input is not cleaned, the <script> tag runs as code in the browser.

2. Step 2: Predict the effect

   The alert('XSS') script runs, showing a popup alert with 'XSS'.

3. Final Answer:

   The alert box with message 'XSS' will appear to the user -> Option A

4. Quick Check:

   Unsanitized script runs alert [OK]

Hint: Unsanitized <script> runs code, shows alert [OK]

Common Mistakes:

• Thinking script tags show as text without sanitizing
• Assuming website crashes from script
• Believing nothing happens without sanitizing

4. A developer wrote this code to display user input safely:

output = user_input.replace("<", "<").replace(">", ">")

But users still report XSS attacks. What is the likely problem?

medium

A. The code only replaces < and > but misses other dangerous characters

B. The code should remove all user input instead of replacing

C. The code runs on the server, but XSS happens on the client

D. The code is perfect; users are mistaken

Solution

1. Step 1: Analyze the replacement method

   Replacing only < and > misses other characters like quotes or script event handlers that can cause XSS.

2. Step 2: Understand XSS complexity

   Effective XSS prevention requires comprehensive escaping or using security libraries, not just partial replacements.

3. Final Answer:

   The code only replaces < and > but misses other dangerous characters -> Option A

4. Quick Check:

   Partial escaping misses XSS vectors [OK]

Hint: Partial escaping misses XSS; escape all special chars [OK]

Common Mistakes:

• Thinking removing input is only solution
• Confusing server vs client execution
• Believing partial replacement is enough

5. A website allows users to post comments that include HTML. To prevent XSS, which combined approach is best?

hard

A. Allow all HTML tags but filter out <script> tags only

B. Use a whitelist to allow only safe HTML tags and escape the rest

C. Escape all user input so no HTML tags run as code

D. Disable comments feature entirely to avoid XSS

Solution

1. Step 1: Understand risks of allowing HTML

   Allowing all HTML except script tags is risky because other tags or attributes can cause XSS.

2. Step 2: Identify best practice

   Using a whitelist to allow only safe tags and escaping others balances usability and security.

3. Step 3: Evaluate other options

   Escaping all input removes HTML functionality; disabling comments reduces user engagement.

4. Final Answer:

   Use a whitelist to allow only safe HTML tags and escape the rest -> Option B

5. Quick Check:

   Whitelist safe tags + escape others = best XSS defense [OK]

Hint: Whitelist safe HTML tags, escape others to stop XSS [OK]

Common Mistakes:

• Allowing all HTML except scripts
• Escaping all input losing HTML features
• Disabling comments instead of fixing XSS