The whole idea behind XSS is that a hacker can
inject client-side code into a website and when the website is viewed by other
users - the code executes and harms the innocent users. As you can guess, the main reason this type
of attack occurs is due to the lack of data validation. XSS attacks can be
broken down into 2 subgroups: Stored & Reflected XSS. Stored XSS is when the malicious code is
permanently stored in the website so either in the database, the actual site
or logs.
Reflected XSS relies on "tricking" the user into going to a
specific "trusted" website where the malicious code could exist in
error messages or even search results.
The pie graph above tells us that XSS is #2 behind SQL Injection in terms how sites are hacked.
note: Due to projects & presentations, I am not able to post much - however, starting next week, I will try to post a bit more about XSS & SQL Injection.
No comments:
Post a Comment