📖 What is Cross-Site Scripting (XSS)?
Cross-Site Scripting (XSS) is a vulnerability where an attacker injects malicious scripts into trusted websites, which are then executed in the victim's browser. This allows attackers to steal session cookies, redirect users, or deface pages by manipulating the client-side code.
"Distinguish between Stored (persistent), Reflected (non-persistent), and DOM-based XSS; the exam often asks which type requires the payload to be saved on the server."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of Cross-Site Scripting (XSS)?
- ▸ Stored XSS occurs when the malicious script is permanently saved on the target server, such as in a database, comment field, or user profile.
- ▸ Reflected XSS involves a payload that is delivered via a link or request and is immediately reflected back to the user's browser without being stored.
- ▸ DOM-based XSS happens entirely on the client side, where the vulnerability exists in the page's JavaScript rather than the server-side code.
- ▸ The primary goal of XSS attacks is often to steal session cookies using document.cookie, enabling session hijacking and unauthorized account access.
- ▸ Effective mitigation strategies include strict input validation, context-aware output encoding, and the implementation of a robust Content Security Policy (CSP).
🎯 How does Cross-Site Scripting (XSS) appear on the PT0-002 Exam?
A scenario might describe a penetration tester finding a vulnerability in a guestbook where any user visiting the page triggers an alert box; identify this as Stored XSS.
You may be asked to analyze a URL containing a script tag in a query parameter and determine that it represents a Reflected XSS attack vector.
Expect questions where you must choose the best remediation for XSS, such as selecting output encoding over simple input filtering to prevent script execution.
❓ Frequently Asked Questions
What is the most critical difference between Reflected and Stored XSS?
The difference is persistence. Reflected XSS requires a victim to click a malicious link to trigger the payload, while Stored XSS is hosted on the server and affects any user who views the compromised page.
Why is DOM-based XSS harder to detect with server-side logs?
Because the payload is processed entirely within the browser's Document Object Model, the malicious script often never reaches the server, leaving no trace in the server-side access or error logs.
How does output encoding prevent XSS attacks?
Output encoding converts special characters (like < and >) into their HTML entity equivalents (like < and >), ensuring the browser renders the input as literal text instead of executing it as code.