Cross-Site Scripting attack on Leetcode

Mon, 07 Dec 2020 00:00:00 +0000

Reflected XSS (Cross-Site Scripting) attack is my favorite vulnerability category as it’s relatively easy to exploit by checking for params as the source and rendering DOM as the sink.

Problem

The core problem of the Reflected Cross-Site scripting attack is appending the URL parameter values in the DOM without validation or filtering. Though the reflected XSS requires user interaction by visiting the page or clicking on links in real-life attacks, people should think about Iframe tags that don’t need any interaction to load them on other third party web pages.

Securing an ExpressJS server - Part 1

Thu, 05 Nov 2020 00:00:00 +0000

As Javascript programming language popularity increases, platforms have already started adopting it from native desktop apps, mobile, browser to server-side, giving rise to exciting frameworks, style guides, tools.

To JavaScript—you weren’t born with a silver spoon in your mouth, but you’ve outclassed every language that’s challenged you in the browser.

ExpressJS is not an exception that powers 2.31% of the top 1 million websites which runs on top of NodeJS and provides excellent features to develop web-based applications. So, let’s jumpstart with a few basics, and this particular series will cover a lot more aspects of securing, maintaining and deploying production-grade expressjs server.

Waf on Shivasurya

Cross-Site Scripting attack on Leetcode

Problem

Securing an ExpressJS server - Part 1