Web Application Security: Vulnerabilities and Mitigations
Web Security Fundamentals
Common Cross-Site Scripting (XSS) Types
| XSS Type | Example Payload | Description |
|---|---|---|
| Reflected XSS | <script>alert(1)</script> | Injected payload reflected immediately in server response. |
| Stored XSS | <img src="x" onerror="alert(1)"> | Payload stored on server (e.g., in database), executed later. |
| DOM-Based XSS | URL: #<script>alert(1)</script> | Payload executed via client-side JavaScript manipulation. |
| Event Handler XSS | <a onclick="alert(1)">Click</a> | Injects event attributes to run JS on user actions. |
| Attribute Injection | "><script>alert(1)</script> | Breaks out of HTML attribute to inject malicious code. |
| JavaScript URI XSS | <a href="javascript:alert(1)">Click</a> | Runs JS via link clicks |
English with a size of 1.73 MB