82ef171a50
* initial cut on XSS, need to add some tests still
* initial unit tests for assignment endpoints
* updating header comment license thingy
* comment, clean up
* Stubs for security unit test
* Additional Unit Testing
* isEncoded and isNotEncoded Unit Tests added
* http-proxies updates
* update for XXE solutions
* Work-around to handle special chars in action ... currently to be able to match {userId} in hint creation/assignment for IDOR
* IDOR hints updated
* mitigation content update
* mitigation content update ... 2
* Lesson Overview updates
* including restart lesson fix for lesson overview
12 lines
518 B
Plaintext
12 lines
518 B
Plaintext
== Stored XSS
|
||
Stored cross-site scripting is different in that the payload is persisted (stored) as opposed to passed/injected via a link.
|
||
|
||
== Stored XSS Scenario
|
||
* Attacker posts malicious script to a message board
|
||
* Message is stored in a server database
|
||
* Victim reads the message
|
||
* The malicious script embedded in the message board post executes in the victim’s browser
|
||
** The script steals sensitive information, like the session id, and releases it to the attacker
|
||
|
||
*Victim does not realize attack occurred*
|