# XSS tutorial for newbies
Hello and welcome to this basic tutorial regarding XSS - What is XSS? Code:XSS stands for Cross-Site scripting, it is essentially when an app, usually a web browser or an app that parses HTML allows u

var unreadAlerts = '1';
Welcome back, purely_cabbage. You last visited: Today, 06:36 AM Log Out
You have one unread private message from dkota titled Welcome to the Forum!
New Reply

Threaded Mode XSS tutorial for newbies

prince97
Administrator
Posts:
145
Threads:
36
Joined:
Feb 2023
Reputation:
49
Credits: 25.6€ [Donate]
View All
#1
02-10-2023, 06:44 PM
Hello and welcome to this basic tutorial regarding XSS
- What is XSS?
Code:
`XSS stands for Cross-Site scripting, it is essentially when an app, usually a web browser or an app that parses HTML allows unsanitized user input to be displayed to other users.`
- How to exploit a simple XSS vulnerability?
Code:
`Example: You found a blog website that allows you to post a comment, good right? Well that website does not sanitize your input to escape characters like <>
What you can do is to insert a simple XSS testing HTML code like: <script>alert("You have been hacked!")</script>
That code would execute on everyone visiting the blog website, now you can do pretty cool things like stealing Cookies and bunch other things e.g. Obtain access to an admin account, Deface the website, etc..`
- How to protect my website or app from XSS?
Code:
`Do not trust the user. Consider everything being supplied by the user is malicious, escape characters from user supplied input, use good coding practices and do your research starting with optimal server configuration that fit your needs to documentation regarding functions and libraries you use in your programming language of choice`
I hope you learned something out of this basic post
If you have any questions, please PM dkota
PM Rate
wiiibx
Newbie
Posts:
9
Threads:
0
Joined:
Apr 2023
Reputation:
0
Credits: 5€ [Donate]
#2
04-22-2023, 09:44 PM
Nice, I highly recommend portswigger to practice and learn more about it!
https://portswigger.net/web-security/cro...exploiting
PM Rate
Reply Quote // Report
trooper
Active Member
Posts:
39
Threads:
5
Joined:
Apr 2023
Reputation:
12
Credits: 5€ [Donate]
#3
04-23-2023, 02:49 AM

> prince97 Wrote: Hello and welcome to this basic tutorial regarding XSS
> - What is XSS?
> Code:
> `XSS stands for Cross-Site scripting, it is essentially when an app, usually a web browser or an app that parses HTML allows unsanitized user input to be displayed to other users.`
> - How to exploit a simple XSS vulnerability?
> Code:
> `Example: You found a blog website that allows you to post a comment, good right? Well that website does not sanitize your input to escape characters like <>
> What you can do is to insert a simple XSS testing HTML code like: <script>alert("You have been hacked!")</script>
> That code would execute on everyone visiting the blog website, now you can do pretty cool things like stealing Cookies and bunch other things e.g. Obtain access to an admin account, Deface the website, etc..`
> - How to protect my website or app from XSS?
> Code:
> `Do not trust the user. Consider everything being supplied by the user is malicious, escape characters from user supplied input, use good coding practices and do your research starting with optimal server configuration that fit your needs to documentation regarding functions and libraries you use in your programming language of choice`
> I hope you learned something out of this basic post

Nicely explained
"It takes just one mistake before they get you, so no mistakes, stay focused"
PM Rate
Reply Quote // Report

« Next Oldest | Next Newest »

New Reply

Quick Reply
Message Type your reply to this message here. Signature Disable Smilies | You have selected one or more posts to quote. Quote these posts now or deselect them.

Possibly Related Threads…
Thread | Author | Replies | Views | Last Post
| Spanish Tutorial Osint Instagram | Error404 | 1 | 253 | 05-07-2023, 08:52 AM Last Post: GlocciniaX

- Subscribe to this thread

Users browsing this thread: purely_cabbage
var thread_deleted = "0"; if(thread_deleted == "1") { $("#quick_reply_form, .new_reply_button, .thread_tools, .inline_rating").hide(); $("#moderator_options_selector option.option_mirage").attr("disabled","disabled"); }