Cross-Site Scripting (XSS)

Reflected, stored and DOM XSS - impact and prevention.

Video tutorialTrack course · freeCodeCamp

Ethical Hacking & Web Security Full Course

Speed

0.75x1x1.25x1.5x2x

Skip intro Next lesson

Watch 00:00 · 2 checkpoints Watch on YouTube More on this topic

Transcript & captions .txt

11/11

1. 00:00Cross-Site Scripting (XSS). Reflected, stored and DOM XSS - impact and prevention.
2. 00:05XSS happens when attacker-controlled input is rendered as code in another user's browser.
3. 00:10The attacker's script then runs with the victim's session: it can read the DOM, call the API as them, or steal tokens.
4. 00:18Reference table: Type, Where the payload lives.
5. 00:23Vulnerable sink vs safe sink (js): // VULNERABLE - raw HTML from user input…
6. 00:28See escaping in action (safe demo) — edit the sample and run it in the browser.
7. 00:34Escape on output, contextually (HTML, attribute, URL, JS).
8. 00:39Prefer textContent and framework binding over innerHTML.
9. 00:44Sanitise rich HTML with a vetted library such as DOMPurify.
10. 00:49Add a strict Content-Security-Policy as defence in depth.
11. 00:54Set HttpOnly on session cookies so script cannot read them.

XSS happens when attacker-controlled input is rendered as code in another user's browser. The attacker's script then runs with the victim's session: it can read the DOM, call the API as them, or steal tokens.

// VULNERABLE - raw HTML from user input
el.innerHTML = params.get('q');

// SAFE - text only, never parsed as HTML
el.textContent = params.get('q');

• Escape on output, contextually (HTML, attribute, URL, JS).
• Prefer textContent and framework binding over innerHTML.
• Sanitise rich HTML with a vetted library such as DOMPurify.
• Add a strict Content-Security-Policy as defence in depth.
• Set HttpOnly on session cookies so script cannot read them.