TryHackMe: Cross-Site Scripting (XSS) Deep Dive

# TryHackMe: Cross-Site Scripting (XSS) Deep Dive ## Understanding XSS Cross-Site Scripting (XSS) allows attackers to inject malicious scripts into web pages viewed by other users. ## Types of XSS ### 1. Stored (Persistent) XSS - Malicious script is stored in the database - Affects all users who view the page - More dangerous than reflected XSS ### 2. Reflected XSS - Malicious script is reflected in the URL - Requires user interaction (clicking a link) - Affects only that user ### 3. DOM-based XSS - Vulnerability exists in client-side code - JavaScript processes user input unsafely ## Real-world Impact - Session hijacking - Credential theft - Malware distribution - Defacement ## Mitigation Strategies 1. Input validation and sanitization 2. Output encoding 3. Content Security Policy (CSP) 4. HTTPOnly and Secure flags on cookies 5. Regular security testing ## Testing for XSS ```javascript