Cross-site scripting (XSS) in Cybersecurity - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is Cross-site scripting (XSS)?

Cross-site scripting (XSS) is a security vulnerability where attackers inject malicious scripts into trusted websites. These scripts run in users' browsers, potentially stealing data or performing harmful actions.

intermediate

Name the three main types of XSS attacks.

The three main types of XSS are:<br>1. Stored XSS: Malicious code is saved on the website's server.<br>2. Reflected XSS: Malicious code is reflected off a web server, like in a URL.<br>3. DOM-based XSS: The attack happens in the browser by manipulating the page's Document Object Model.

beginner

Why is XSS dangerous for users?

XSS is dangerous because it can steal sensitive information like cookies, session tokens, or personal data. It can also trick users into actions like clicking fake links or submitting forms without their knowledge.

intermediate

How can developers prevent XSS attacks?

Developers can prevent XSS by:<br>1. Validating and sanitizing user input.<br>2. Encoding output to safely display data.<br>3. Using security headers like Content Security Policy (CSP).<br>4. Avoiding unsafe JavaScript functions that insert HTML directly.

intermediate

What role does Content Security Policy (CSP) play in XSS protection?

Content Security Policy (CSP) is a security feature that restricts which scripts can run on a webpage. It helps block malicious scripts injected by attackers, reducing the risk of XSS attacks.

Which type of XSS stores malicious code on the website's server?

A SQL Injection

B Reflected XSS

C DOM-based XSS

D Stored XSS

Stored XSS saves the malicious script on the server, so it runs whenever a user accesses the infected page.

What is a common goal of an XSS attack?

A Increase website speed

B Steal user cookies

C Improve SEO ranking

D Backup website data

Attackers often use XSS to steal cookies, which can give them access to user accounts.

Which method helps prevent XSS by restricting allowed scripts on a webpage?

A Content Security Policy (CSP)

B Firewall

C Antivirus software

D Password encryption

CSP controls which scripts can run, blocking unauthorized or malicious scripts.

Reflected XSS attacks usually happen through:

A User input reflected in URLs or forms

B Malicious code saved in the database

C Manipulating browser extensions

D Physical access to the server

Reflected XSS occurs when malicious input is immediately reflected back in a webpage, often via URLs or form inputs.

Which practice is NOT effective against XSS?

A Sanitizing user input

B Encoding output

C Using strong passwords

D Implementing CSP

Strong passwords protect accounts but do not prevent XSS attacks directly.

Explain what Cross-site scripting (XSS) is and why it is a security risk.

Think about how attackers use websites to run harmful code in your browser.

Describe three main types of XSS attacks and how they differ.

Consider where the bad script is saved or how it reaches the user.