Principles of website attack methods

Principles of website attack methods The principle of


xss (cross-site scripting attack)
:
1. Read other people's cookie information through scripts, and then you can modify the relevant information after logging in to other people's accounts.
2. By injecting the script into the comment, as long as the user clicks, the user's cookie information will be read.

Defense:
1. Add filtering of input content to comments to prevent script injection.
2. Add the HttpOnly tag to the cookie. The HttpOnly tag will tell the browser that the marked cookie is not allowed to be read or modified by any script,
so even if the web application has an XSS vulnerability, the cookie information can be better protected to reduce losses. The principle of


CSRF attack (cross-site request forgery) : 1. The user logs in to the target website and can log in to the hacker website at the same time. When the resource obtained by the hacker website with a resource tag (such as img) is the target website and provides services, the hacker website will The purpose of accessing the destination URL resource with your account has been achieved. Defense: 1. To defend against CSRF vulnerabilities on the web application side, generally use referer, token or verification code