JobCannon
全部技能

Cross-Site Scripting Advanced

⬢ 層級 2技術
高
薪資影響
2 個月
學習時長
困難
難度
2
職業
一覽

Cross-Site Scripting (XSS) is injecting malicious JavaScript into a web app, then executing it in victim browsers to steal data or hijack sessions. Most web developers know basics (escape output, no innerHTML). Advanced XSS requires: understanding encoding (HTML, URL, CSS, JS), XSS contexts (attribute vs text node), DOM-based flows, and evasion techniques. Mastery takes 4-6 weeks. Senior security engineers earn $180-280k because they find and fix XSS before hackers do. Becoming one of the 5% of developers who can audit XSS comprehensively is a security-critical skill.

什麼是 Cross-Site Scripting Advanced

Cross-Site Scripting (XSS) is injecting malicious JavaScript code into a web application, then executing it in victim browsers. Example: a comment form accepts user input. An attacker submits . If the app renders the comment without escaping, the script executes in other users' browsers, stealing their session cookies. Advanced XSS covers: stored XSS (payload saved permanently), reflected XSS (payload in URL), DOM-based XSS (vulnerability in browser JavaScript), context-aware escaping, CSP evasion, and exploitation.

🔧 工具與生態
Burp SuiteOWASP ZAPBrowser DevToolsPayload encoding toolsDOM clobbering detectorsTemplate injection testersContent Security Policy testingStatic analysis (Semgrep)Dynamic testing frameworksHTML parser theory

💰 各地區薪資

地區初級中級高級
USA$95,000$160,000$260,000
UK£60,000£100,000£165,000
EU€65,000€110,000€180,000
CANADACA$100,000CA$170,000CA$275,000

🎯 使用 Cross-Site Scripting Advanced 的職業

Penetration Tester
Security Engineer

❓ 常見問題

What's the difference between stored and reflected XSS?
Stored: payload saved in database (e.g., malicious comment). When others view it, the payload executes. Affects all users. Reflected: payload in URL query parameter. When user clicks the link, payload executes in their browser only. Stored is worse (affects many). Both are critical.
What's DOM-based XSS and why is it harder to find?
DOM-based XSS: vulnerability in JavaScript code that unsafely uses user input. Example: document.body.innerHTML = userInput (if userInput contains script tags, they execute). No server-side interaction. Harder to find because static analysis can't always trace the flow. Requires code review or dynamic testing.
How do you bypass HTML encoding?
HTML encoding escapes &, <, >, ", '. But context matters. If input is in an HTML attribute, you need to escape differently. Example: <img src=x onerror="alert('xss')"> bypasses HTML encoding if placed in attribute. Use context-aware encoding (HTML vs HTML attribute vs URL vs JS).
What's a CSP header and does it prevent XSS?
CSP (Content-Security-Policy) restricts where scripts can load from. Example: CSP: script-src 'self' (only scripts from your domain). Prevents inline scripts or scripts from CDNs unless whitelisted. Not foolproof but raises the bar. Strict CSP (no 'unsafe-inline') prevents most XSS.
How do you test for DOM clobbering?
DOM clobbering: creating an element with id that shadows a JavaScript variable. Example: <form id=x></form> shadows a variable x = {}. If code checks if(x.y) but x is now the form, behavior breaks. Attacker can clobber critical variables. Test by injecting HTML elements and checking if JavaScript breaks.
What's a prototype pollution vulnerability and how does it lead to XSS?
Prototype pollution: modifying Object.prototype so all objects inherit polluted properties. Example: pollution with '__proto__.polluted=true' makes all objects have polluted property. If JavaScript checks if(obj.trusted), attacker pollutes Object.prototype.trusted=true, bypassing check. Can lead to XSS if combined with unsafe template use.
How do you write a secure template engine?
Use auto-escaping (all output escaped by default). Let users opt-in to unescaping (mark as safe explicitly). Example: {{ username }} auto-escapes, {{ username|safe }} does not. Audit all |safe usages before ship. Most template engines have escaping; don't disable it.

不確定這項技能適不適合你？

做一下職業匹配，我們會推薦合適的方向。

找到最適合我的技能 →

找到理想的職業方向

在 2,521 個職業中進行技能匹配。免費。

免費做職業匹配 →