XSS Defense
Stored, reflected, DOM — defend with encode, CSP, and safe APIs on YOUR toy app.
Visual · xss_defense
XSS defense literacy. $MY_REPO only. Original Cyberlium.
XSS is untrusted data executed as script — fix sinks in YOUR repo, not carts on the internet.
Cross-Site Scripting (XSS) classes: reflected (immediate response), stored (persisted then viewed), DOM-based (client-side sink). Defense: context encoding, Content-Security-Policy, avoid innerHTML with user data, use framework safe bindings. Cyberlium teaches fixing one sink in $TOY_APP — not dropping alert(1) on live e-commerce or café loyalty pages. You will NOT ship XSS PoCs against stranger shops as 'homework proof.' Next: SQL Bind.
1. Three XSS classes developers name
Reflected: search query echoed unencoded. Stored: comment saved and rendered raw. DOM: location.hash written to innerHTML in SPA code.
On $MY_REPO, identify which class your toy app could suffer and fix the render path with encoding or safe API.
Command guide
Try these commands — Three XSS classes developers name
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
XSS prevention — https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html CSP — https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
python3 -c "import html; p='<img src=x onerror=alert(1)>'; print(html.escape(p))" grep -rE 'innerHTML|dangerouslySetInnerHTML' "$HOME/cyberlium-lab/t17-toy" 2>/dev/null | head -5 || echo 'Search MY_REPO for unsafe DOM sinks'
Primary tools to practice this lesson: python3, grep. Reference sites: XSS prevention (https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html); CSP (https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. CSP as belt, encoding as suspenders
Content-Security-Policy limits script sources — useful on $TOY_APP lab deploy. It does not replace encoding user data in templates.
Defenders monitor CSP violations; developers remove dangerous sinks — both on code you own.
3. No live shop script tags
Testing XSS on production stranger sites is unauthorized — out of scope. Localhost lab with your own test strings only.
Ship: one XSS fix (encode or CSP header) on $TOY_APP. Next: SQL Bind.
4. What you ship: XSS defense fix for $TOY_APP
Name XSS class addressed. Encoding or CSP fix in $MY_REPO. NEVER live shop PoCs. chmod 600.
5. What you record before the next lesson
Date. XSS class and fix. File t17-m04-l02-xss-defense.txt chmod 600.
6. Wrong vs right: stranger apps vs YOUR repo
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Stored XSS on live product reviews. innerHTML(userComment) without encode in $TOY_APP.
- Right: Fix one XSS path on $TOY_APP. Next: SQL Bind.
Mission: fix one XSS sink
1) Identify reflected, stored, or DOM risk in $TOY_APP. 2) Apply encoding or safe API fix in $MY_REPO. 3) Test on localhost only. Never XSS stranger production.
Stuck? Ask Cyberlium AI Mentor
textContent beats innerHTML for plain user text — when semantics allow.
APPLY: Stored XSS means:
APPLY: True or False: XSS PoCs on live shop review forms are Cyberlium homework.
APPLY: CSP on $TOY_APP helps by: