JobCannon
Alla kompetenser

Cross-Site Scripting Advanced

⬢ NIVÅ 2Tekniskt
Hög
Lönepåverkan
2 månader
Tid att lära sig
Svår
Svårighetsgrad
2
Karriärer
I korthet

Cross-Site Scripting (XSS) is injecting malicious JavaScript into a web app, then executing it in victim browsers to steal data or hijack sessions. Most web developers know basics (escape output, no innerHTML). Advanced XSS requires: understanding encoding (HTML, URL, CSS, JS), XSS contexts (attribute vs text node), DOM-based flows, and evasion techniques. Mastery takes 4-6 weeks. Senior security engineers earn $180-280k because they find and fix XSS before hackers do. Becoming one of the 5% of developers who can audit XSS comprehensively is a security-critical skill.

Vad är Cross-Site Scripting Advanced

Cross-Site Scripting (XSS) is injecting malicious JavaScript code into a web application, then executing it in victim browsers. Example: a comment form accepts user input. An attacker submits . If the app renders the comment without escaping, the script executes in other users' browsers, stealing their session cookies. Advanced XSS covers: stored XSS (payload saved permanently), reflected XSS (payload in URL), DOM-based XSS (vulnerability in browser JavaScript), context-aware escaping, CSP evasion, and exploitation.

🔧 VERKTYG & EKOSYSTEM
Burp SuiteOWASP ZAPBrowser DevToolsPayload encoding toolsDOM clobbering detectorsTemplate injection testersContent Security Policy testingStatic analysis (Semgrep)Dynamic testing frameworksHTML parser theory

💰 Lön per region

OmrådeNybörjareMidErfaren
USA$95k$160k$260k
UK£60k£100k£165k
EU€65k€110k€180k
CANADAC$100kC$170kC$275k

🎯 Karriärer som använder Cross-Site Scripting Advanced

Penetration Tester
Security Engineer

❓ Vanliga frågor

What's the difference between stored and reflected XSS?
Stored: payload saved in database (e.g., malicious comment). When others view it, the payload executes. Affects all users. Reflected: payload in URL query parameter. When user clicks the link, payload executes in their browser only. Stored is worse (affects many). Both are critical.
What's DOM-based XSS and why is it harder to find?
DOM-based XSS: vulnerability in JavaScript code that unsafely uses user input. Example: document.body.innerHTML = userInput (if userInput contains script tags, they execute). No server-side interaction. Harder to find because static analysis can't always trace the flow. Requires code review or dynamic testing.
How do you bypass HTML encoding?
HTML encoding escapes &, <, >, ", '. But context matters. If input is in an HTML attribute, you need to escape differently. Example: <img src=x onerror="alert('xss')"> bypasses HTML encoding if placed in attribute. Use context-aware encoding (HTML vs HTML attribute vs URL vs JS).
What's a CSP header and does it prevent XSS?
CSP (Content-Security-Policy) restricts where scripts can load from. Example: CSP: script-src 'self' (only scripts from your domain). Prevents inline scripts or scripts from CDNs unless whitelisted. Not foolproof but raises the bar. Strict CSP (no 'unsafe-inline') prevents most XSS.
How do you test for DOM clobbering?
DOM clobbering: creating an element with id that shadows a JavaScript variable. Example: <form id=x></form> shadows a variable x = {}. If code checks if(x.y) but x is now the form, behavior breaks. Attacker can clobber critical variables. Test by injecting HTML elements and checking if JavaScript breaks.
What's a prototype pollution vulnerability and how does it lead to XSS?
Prototype pollution: modifying Object.prototype so all objects inherit polluted properties. Example: pollution with '__proto__.polluted=true' makes all objects have polluted property. If JavaScript checks if(obj.trusted), attacker pollutes Object.prototype.trusted=true, bypassing check. Can lead to XSS if combined with unsafe template use.
How do you write a secure template engine?
Use auto-escaping (all output escaped by default). Let users opt-in to unescaping (mark as safe explicitly). Example: {{ username }} auto-escapes, {{ username|safe }} does not. Audit all |safe usages before ship. Most template engines have escaping; don't disable it.

Osäker på om den här kompetensen passar dig?

Gör Career Match — vi föreslår rätt spår för dig.

Hitta mina bäst passande kompetenser →

Hitta din ideala karriärväg

Kompetensbaserad matchning mot 2 521 karriärer. Gratis, ~3 minuter.

Gör Karriärmatchningen — gratis →