What Is Cross Site Scripting (XSS)? | Cross Site Scripting Explained |XSS Attack | Simplilearn — Transcript

Full transcript

1. 0:04hey everyone welcome back to the channel
2. 0:05today we are diving into the complex yet
3. 0:08fascinating world of crite scripting
4. 0:10commonly known as xss this isn't just
5. 0:12any Tech topic it's a critical security
6. 0:14issue that's affected 40% of the
7. 0:17websites at some point according to
8. 0:19recent cyber security reports but what
9. 0:21exactly is xss well imagine you are
10. 0:24shopping online and suddenly without
11. 0:26clicking anything a popup appears or you
12. 0:28find yourself d to another site that's
13. 0:31xss a hacker has injected malicious code
14. 0:34into what looked like a harmless web
15. 0:36page now let me tell you a quick story a
16. 0:38few years back a major retail website
17. 0:40was hit by an xss attack right during
18. 0:43their busy holiday season hackers
19. 0:44managed to slip malicious scripts into
20. 0:46the product review sections and the
21. 0:48script ran automatically when other
22. 0:50Shoppers viewed the reviews the result
23. 0:53thousands of customers had the personal
24. 0:55information stolen right under their
25. 0:56noses the beach not only caused millions
26. 0:59in Damages but also the trust of the
27. 1:01customers so whether you are a buring
28. 1:03web developer a cybercity Enthusiast or
29. 1:06just someone who shops online
30. 1:08understanding xss is crucial today we
31. 1:10are going to break down how these
32. 1:12attacks happen show you real examples of
33. 1:14xss in action and most importantly share
34. 1:17you how you can protect your websites
35. 1:19and personal information from these
36. 1:20attacks we've got a lot to cover so make
37. 1:23sure you like subscribe and hit that
38. 1:25Bell icon to stay updated let's jump
39. 1:27right into understanding and preventing
40. 1:29xss and ensure you are armed with the
41. 1:31knowledge to safeguard your digital
42. 1:33presence craving a career upgrade
43. 1:36subscribe like and comment
44. 1:39below dive into the link in the
45. 1:42description to FastTrack your Ambitions
46. 1:45whether you're making a switch or aiming
47. 1:47higher simply learn has your
48. 1:51back and before you commence guys if
49. 1:54you're an aspiring cyber security
50. 1:55professional looking for online training
51. 1:57and certification from prestigious
52. 1:58universities and in collaboration with
53. 2:00leading experts to enhance your
54. 2:02credibility then search no more simply
55. 2:04Larch postgraduate program in cyber
56. 2:06security from Mi University in
57. 2:08collaboration with EC Council should be
58. 2:10right choice for more details you can
59. 2:12find the link in the description box and
60. 2:13pin comment so stay tuned with us until
61. 2:15the end of this video and don't forget
62. 2:17to register your opinion in the comment
63. 2:19section below so let's get started so
64. 2:21guys let's start with what is crite
65. 2:23scripting so xss is a security flow in
66. 2:26web applications where attackers inject
67. 2:28malicious scripts into web pages that
68. 2:31other users View and interact with this
69. 2:33allows attackers to execute scripts in
70. 2:35the victim's browser potentially
71. 2:37stealing information impersonating them
72. 2:40or altering web page content so let's
73. 2:42have a look at brief history and
74. 2:44evolution of xss vulnerabilities these
75. 2:47vulnerabilities are discovered in the
76. 2:481990s and the xss has evolved from a
77. 2:51minor annoyance to a major threat as the
78. 2:54internet became more integral to daily
79. 2:56and business activities despite
80. 2:59advancements in web security xss remains
81. 3:02a prevalent issue due to the complex
82. 3:04nature of modern web applications so
83. 3:06let's say an example for the xss suppose
84. 3:09a website has a search function that
85. 3:11directly displays user input in the
86. 3:13search results page without proper
87. 3:15sanitization an attacker crafts a URL
88. 3:18that includes a search term like as you
89. 3:21can see on the screen that is script
90. 3:22alert xss detected so when another user
91. 3:25Clicks in this link or enters this
92. 3:27script in the search box the m script
93. 3:30runs in the browser displaying an alert
94. 3:33box so this is how a xss attack happens
95. 3:37now we move to the types of attacks so
96. 3:39the number one on the list is reflected
97. 3:41accss that occurs when malicious scripts
98. 3:44are embedded in a URL which executes
99. 3:47when the URL is visited and the common
100. 3:49insights that reflect user input like
101. 3:52search engines next on the list is
102. 3:54stored xss that happens when malicious
103. 3:57scripts are permanently stored on target
104. 3:59servers such as in comment sections or
105. 4:02forums the script is then served to
106. 4:04users who view the infected content then
107. 4:07comes the do based accss this involves
108. 4:10client side code vulnerability where the
109. 4:12document object model that is dome
110. 4:14environment is manipulated to execute
111. 4:17unwanted actions without needing to
112. 4:19communicate with the server so these are
113. 4:21the types of accss attacks now moving to
114. 4:23how xss attacks work so xss attacks
115. 4:27manipulate web applications to execute m
116. 4:29ious scripts on the users browser
117. 4:32attackers craft inputs that are
118. 4:33incorrectly trusted and executed as code
119. 4:36by the web application so let's
120. 4:38understand this with the help of an
121. 4:39example let's imagine a simple example
122. 4:42of a stored xss attack and we will
123. 4:45imagine a scenario on a social media
124. 4:47website first we'll see how we can post
125. 4:49a comment let's suppose someone let's
126. 4:51call them Alex post a comment on an
127. 4:53article but Alex command isn't just text
128. 4:56it includes a hidden snippet of code
129. 4:58that looks like less text but actually
130. 5:01has a script embedded in it now we'll
131. 5:03see the website doesn't check it and the
132. 5:06comments are not checked that contain
133. 5:08anything dangerous like scripts so it
134. 5:10saves Alex command with the script in it
135. 5:13just like any other command now when
136. 5:15other users like Bob or Charlie or any
137. 5:18one person read the article they see
138. 5:21Alex comment so without knowing when Bob
139. 5:23and charie view the comment the hidden
140. 5:25script in the comment runs automatically
141. 5:27on the browsers the script Secret sends
142. 5:30Bobs and Charlie information like the
143. 5:32cookies which can keep track of who they
144. 5:34are on the website back to Alex Alex can
145. 5:37now potentially access BS and Charlie's
146. 5:39accounts without the passwords this
147. 5:42example shows why websites need to check
148. 5:44and clean up any data like commands
149. 5:46submitted by users to prevent such
150. 5:48attacks this checking process is called
151. 5:50sanitizing by sanitizing inputs websites
152. 5:53can make sure no harmful scripts are
153. 5:55stored and later executed so this is the
154. 5:58best example for the accs attack now
155. 6:00we'll move to the common methods of xss
156. 6:03injection so the number one on the list
157. 6:05is user input attackers May inject
158. 6:08scripts via form fields or URL
159. 6:10parameters for instance adding a script
160. 6:12tag in a command field that executes
161. 6:14when other users view the comment next
162. 6:16is malicious content posting scripts in
163. 6:19user generated content areas like
164. 6:21commands forums or user profiles an
165. 6:23example is a user posting a malicious
166. 6:25script in an online Forum that steals
167. 6:27cookies from every visitor who use the
168. 6:30post the next is third party components
169. 6:33using third party scripts or plugins
170. 6:34that contain vulnerabilities an attacker
171. 6:37might exploit a vulnerable plugin to
172. 6:39inject malicious scripts into a website
173. 6:41that uses it so these are the common
174. 6:43methods of accss injection now we see
175. 6:46the impacts of xss so xss attacks can
176. 6:49allow attackers to steal cookies session
177. 6:52tokens or other sensitive information
178. 6:54that can be used to impersonate the
179. 6:56victim attackers can manipulate or
180. 6:58defense the website content seen by
181. 7:00users which can damage the website's
182. 7:02reputation and Trust accss can be used
183. 7:05to deliver malware to users potentially
184. 7:07leading to further exploit such as
185. 7:09ransomware or spyware now we'll see the
186. 7:12real world consequences and examples of
187. 7:14major accesses attacks so the number one
188. 7:17consequence is financial damage
189. 7:19companies might face significant
190. 7:21financial losses due to stolen data or
191. 7:23FR along with cost related to securing
192. 7:25the breach and potential fines for data
193. 7:28protection failures the next is
194. 7:30reputation damage a successful accesses
195. 7:33attack can damage a company's reputation
196. 7:35leading to Lost customers and decreased
197. 7:37trust in the brand then comes the legal
198. 7:40consequences businesses May face legal
199. 7:42actions if customer data is compromised
200. 7:45especially under regulations like gdpr
201. 7:48now we see an example of a major access
202. 7:50attack so we'll not name the website but
203. 7:53a welln social media platform
204. 7:54experienced an accss attack where
205. 7:56malicious scripts were inserted into
206. 7:58profile pages
207. 8:00this script automatically executed
208. 8:02whenever the profile was viewed
209. 8:03spreading the tag across the user base
210. 8:05it led to widespread unauthorized access
211. 8:07to personal information and was a major
212. 8:10privacy breach so now moving to
213. 8:12detecting and mitigating accss
214. 8:14vulnerabilities starting with the
215. 8:16detecting so starting with detecting xss
216. 8:18vulnerabilities so the number one on the
217. 8:20list is tools for identification use
218. 8:23automated security tools like oap zap BB
219. 8:25suit and xss scanners that can help
220. 8:28detect potential X ACC vulnerabilities
221. 8:30in web applications by simulating
222. 8:32attacks the next on the list is manual
223. 8:34testing Security Experts often perform
224. 8:36manual testing alongside automated tools
225. 8:38to catch nuances that machines might
226. 8:41miss the next is common science frequent
227. 8:44unexplained redirects or unusual popups
228. 8:46on a site can be indicative of access's
229. 8:49vulnerabilities the next on the list is
230. 8:51code review regularly review and audit
231. 8:53source code for potential accss
232. 8:55vulnerabilities focusing on how user
233. 8:58inputs are handled then comes security
234. 9:00headers use HTTP security headers like X
235. 9:03content type options and X accss
236. 9:07protection to enhance protection against
237. 9:09xss so these were the detecting options
238. 9:12for xss vulnerabilities now we'll see
239. 9:15prevention and mitigating them so the
240. 9:17number one on the list is coding best
241. 9:19practices employees secure coding
242. 9:21standards that include escaping user
243. 9:23input using safe API functions and
244. 9:26applying least privilege principles the
245. 9:28next is security measures Implement
246. 9:31content security policy CSP which helps
247. 9:34implementing xss by restricting the
248. 9:36sources from which scripts can be loaded
249. 9:39the next is input sanitization validate
250. 9:42and sanitize all user inputs to ensure
251. 9:44that Mala scripts are not executed
252. 9:46Frameworks like react automatically
253. 9:48Escape outputs reducing the risk of
254. 9:51excesses the next is output encoding
255. 9:54always encode output not just input to
256. 9:57ensure that special characters are not
257. 9:58executed as code and the next is use of
258. 10:02security libraries Implement libraries
259. 10:04and Frameworks that are designed to
260. 10:06defend against accss by providing
261. 10:08functions that handle escaping and
262. 10:10sanitizing these methods form the core
263. 10:12of a robust strategy to detect prevent
264. 10:14and mitigate accss attacks ensuring that
265. 10:17web applications are secure against this
266. 10:19common and dangerous type of cyber
267. 10:21threat and with that guys we have come
268. 10:23to the end of this session if you like
269. 10:24this session please like share and
270. 10:25subscribe if you have any doubts comment
271. 10:27down in the comment section below thanks
272. 10:29for watching stay tuned for more from
273. 10:31Simply learn staying ahead in your
274. 10:33career requires continuous learning and
275. 10:36upskilling whether you're a student
276. 10:38aiming to learn today's top skills or a
277. 10:41working professional looking to advance
278. 10:44your career we've got you covered
279. 10:47explore our impressive catalog of
280. 10:49certification programs in cuttingedge
281. 10:51domains including data science cloud
282. 10:54computing cyber security AI machine
283. 10:57learning or digital marketing designed
284. 11:00in collaboration with leading
285. 11:02universities and top corporations and
286. 11:05delivered by industry experts choose any
287. 11:08of our programs and set yourself on the
288. 11:11path to Career Success click the link in
289. 11:14the description to no
290. 11:20more hi there if you like this video
291. 11:22subscribe to the simply learn YouTube
292. 11:24channel and click here to watch similar
293. 11:27videos to nerd up and get certified
294. 11:29click here