Cross Site Scripting

The video tutorial explains cross-site scripting (XSS), a vulnerability allowing attackers to inject malicious code into web applications. It covers two main types: reflected XSS, which is non-persistent and occurs when a script is reflected off a web application, and stored XSS, which is persistent and involves injecting a script into a web application. The tutorial provides examples of both types and discusses prevention methods, such as using secure frameworks, input sanitization, and content security policies.

What is the primary difference between reflected and stored XSS attacks?

• Stored XSS is persistent, while reflected XSS is not.

• Reflected XSS is persistent, while stored XSS is not.

• Stored XSS occurs on the server, while reflected XSS occurs on the client.

• Reflected XSS occurs on the server, while stored XSS occurs on the client.

How does a reflected XSS attack typically get activated?

• By downloading a malicious file from the internet.

• By clicking on a link that sends a request to a vulnerable website.

• Through a direct injection into the web server.

• Through a malicious script stored in the database.

In a reflected XSS attack, where does the vulnerability primarily exist?

• In the victim's browser.

• In the network firewall settings.

• In the web server's configuration.

• In the web application's database.

What makes stored XSS attacks more damaging than reflected XSS attacks?

• They are harder to detect.

• They are executed only once.

• They are persistent and affect multiple users.

• They require physical access to the server.

Where is a malicious script typically injected in a stored XSS attack?

• In the web application's database.

• In the server's operating system.

• In the user's browser cache.

• In the network router.

Which of the following is a recommended practice to prevent XSS attacks?

• Sanitizing and encoding user inputs and outputs.

• Allowing all types of user-generated content.

• Using outdated web frameworks.

• Disabling all JavaScript on the website.

What role does a Content Security Policy (CSP) play in preventing XSS attacks?

• It restricts the sources from which scripts can be loaded.

• It encrypts all data stored in the database.

• It disables all cookies on the website.

• It blocks all incoming traffic to the website.