Cross-Site Scripting attack on Leetcode

Mon, 07 Dec 2020 00:00:00 +0000

Reflected XSS (Cross-Site Scripting) attack is my favorite vulnerability category as it’s relatively easy to exploit by checking for params as the source and rendering DOM as the sink.

Problem

The core problem of the Reflected Cross-Site scripting attack is appending the URL parameter values in the DOM without validation or filtering. Though the reflected XSS requires user interaction by visiting the page or clicking on links in real-life attacks, people should think about Iframe tags that don’t need any interaction to load them on other third party web pages.

Xss on Shivasurya

Cross-Site Scripting attack on Leetcode

Problem