JobCannon
Tutte le competenze

Cross-Site Scripting Advanced

⬢ LIVELLO 2Tecniche
Alto
Impatto sullo stipendio
2 mesi
Tempo di apprendimento
Difficile
Difficoltà
2
Carriere
In sintesi

Cross-Site Scripting (XSS) is injecting malicious JavaScript into a web app, then executing it in victim browsers to steal data or hijack sessions. Most web developers know basics (escape output, no innerHTML). Advanced XSS requires: understanding encoding (HTML, URL, CSS, JS), XSS contexts (attribute vs text node), DOM-based flows, and evasion techniques. Mastery takes 4-6 weeks. Senior security engineers earn $180-280k because they find and fix XSS before hackers do. Becoming one of the 5% of developers who can audit XSS comprehensively is a security-critical skill.

Cos'è Cross-Site Scripting Advanced

Cross-Site Scripting (XSS) is injecting malicious JavaScript code into a web application, then executing it in victim browsers. Example: a comment form accepts user input. An attacker submits . If the app renders the comment without escaping, the script executes in other users' browsers, stealing their session cookies. Advanced XSS covers: stored XSS (payload saved permanently), reflected XSS (payload in URL), DOM-based XSS (vulnerability in browser JavaScript), context-aware escaping, CSP evasion, and exploitation.

🔧 STRUMENTI ED ECOSISTEMA
Burp SuiteOWASP ZAPBrowser DevToolsPayload encoding toolsDOM clobbering detectorsTemplate injection testersContent Security Policy testingStatic analysis (Semgrep)Dynamic testing frameworksHTML parser theory

💰 Stipendio per regione

RegioneLivello baseMidLivello esperto
USA$95k$160k$260k
UK£60k£100k£165k
EU€65k€110k€180k
CANADAC$100kC$170kC$275k

🎯 Carriere che usano Cross-Site Scripting Advanced

Penetration Tester
Security Engineer

❓ Domande frequenti

What's the difference between stored and reflected XSS?
Stored: payload saved in database (e.g., malicious comment). When others view it, the payload executes. Affects all users. Reflected: payload in URL query parameter. When user clicks the link, payload executes in their browser only. Stored is worse (affects many). Both are critical.
What's DOM-based XSS and why is it harder to find?
DOM-based XSS: vulnerability in JavaScript code that unsafely uses user input. Example: document.body.innerHTML = userInput (if userInput contains script tags, they execute). No server-side interaction. Harder to find because static analysis can't always trace the flow. Requires code review or dynamic testing.
How do you bypass HTML encoding?
HTML encoding escapes &, <, >, ", '. But context matters. If input is in an HTML attribute, you need to escape differently. Example: <img src=x onerror="alert('xss')"> bypasses HTML encoding if placed in attribute. Use context-aware encoding (HTML vs HTML attribute vs URL vs JS).
What's a CSP header and does it prevent XSS?
CSP (Content-Security-Policy) restricts where scripts can load from. Example: CSP: script-src 'self' (only scripts from your domain). Prevents inline scripts or scripts from CDNs unless whitelisted. Not foolproof but raises the bar. Strict CSP (no 'unsafe-inline') prevents most XSS.
How do you test for DOM clobbering?
DOM clobbering: creating an element with id that shadows a JavaScript variable. Example: <form id=x></form> shadows a variable x = {}. If code checks if(x.y) but x is now the form, behavior breaks. Attacker can clobber critical variables. Test by injecting HTML elements and checking if JavaScript breaks.
What's a prototype pollution vulnerability and how does it lead to XSS?
Prototype pollution: modifying Object.prototype so all objects inherit polluted properties. Example: pollution with '__proto__.polluted=true' makes all objects have polluted property. If JavaScript checks if(obj.trusted), attacker pollutes Object.prototype.trusted=true, bypassing check. Can lead to XSS if combined with unsafe template use.
How do you write a secure template engine?
Use auto-escaping (all output escaped by default). Let users opt-in to unescaping (mark as safe explicitly). Example: {{ username }} auto-escapes, {{ username|safe }} does not. Audit all |safe usages before ship. Most template engines have escaping; don't disable it.

Non sei sicuro che questa competenza faccia per te?

Fai il Career Match — ti suggeriremo i percorsi giusti.

Trova le competenze adatte a te →

Trova il tuo percorso di carriera ideale

Abbinamento basato sulle competenze per 2521 carriere. Gratis, ~3 minuti.

Fai il Career Match — gratis →