Basic concepts and basic ideas of XSS basics for web security attack and defense

1 Introduction and comparison

XSS attacks can be divided into three types

1. Reflective type: one-time, spread by mail, need to go through the server
2. Dom type (Document Object Model): One-time, no need to go through the server (no message sent)
3. Storage type: Persistent, usually appear in the message board, usually in a trusted link (familiar forum website)

Both the reflection type and the storage type need to send information to the outside and return it after passing through the server, while the DOM type is parsed and executed by the local browser.

The simplest check method to distinguish between reflective and DOM is "Burp capture". If Burp captures data, it is reflective, and if it cannot capture data, it is DOM. (Teached by Master Tong Tong during the interview

The DOM type and the reflection type are usually used by the attacker to construct the URL, and the storage type is the input point for constructing the payload test website.

• DOM type: data => client
• Reflective type: data => server => client
• Storage type: data => server => database => client

2 Defense against XSS

XSS repair is divided into two parts: input and output. Through filtering, the entered malicious code is intercepted to the outside (similar to the security check of an airplane). You must also pay attention to the output, otherwise the malicious code entered in the past may also cause XSS.

1. Filter illegal characters such as', ", <, >, on*.
2. The data output to the page requires HTML entity coding and Javascript coding.

3 Basic idea

• The existence of XSS must be accompanied by the two concepts of input and output (so input filtering and output coding are required for defense in defense). It is not convenient to filter when outputting. If 3<5 is written in the article, it will only be 3 to 5 after being filtered. Therefore, coding defenses are often used in output instead of filtering.
• XSS and SQL injection are similar. Both text is executed as code. The difference is that XSS code is executed on the client side, and SQL injection code is executed on the server side.