Web application attacks, such as cross-site scripting (XSS), are constantly top-of-mind for enterprise security professionals, and for good reason: They can do a great deal of damage. Cross-site scripting
This mini learning guide, brought to you by SearchSecurity.com, can be used as a preventative XSS cheat sheet, highlighting the threats and risks of cross-site scripting, and offering advice on enterprise XSS protection and prevention, as well as detection methods for identifying cross-site scripting exploits.
Zero-Day Initiative fixes record number of vulnerabilities
Web application vulnerabilities have been, and will continue to be, the attack method of choice for hackers and cybercriminals. And, according to HP-TippingPoint’s Zero-Day Initiative (ZDI),Web application vulnerabilities are on the rise, making cross-site scripting (XSS) prevention and detection just as important now as it was years ago.
to prevent cross-site scripting
Cross-site scripting, a common Web application attack technique, presents significant risks to an organization considering an XSS attack is capable using malicious coding to steal a user’s information and cookies and conduct transactions.
In this Q&A, information security threats expert Ed Skoudis explains how cross-site scripting attacks are conducted and what Web security experts and Web developers can do to protect their websites and applications against them.
tracing vs. Cross-site scripting
Cross-site tracing (XST), similar to cross-site scripting, can do significant damage to Web applications, making it imperative for security pros to understand the dangers that XST attacks can introduce, and how they are different from cross-site scripting attacks.
In this SearchSecurity.com expert response, Ed Skoudis discusses the differences between the two attack methods, reveals how each attack is carried out, and offers advice on how to keep applications safe from both XST and XSS attacks.
are the risks of social networking sites?
Social networking sites can be useful in maintaining friendships and making connections in both a personal and professional environment. However, these sites can be a security professional’s worst nightmare. Sites like Twitter, MySpace and YouTube can be a haven for cybercriminals, giving them a means to post and spread malware, as well as execute other malicious attacks.
In this Q&A, Ed Skoudis reveals how several attack methods, such as cross-site scripting, can be executed and spread via popular social networking mediums and how enterprises can successfully thwart these threats.
From cross-site scripting to SQL injection, hackers have many techniques at their disposal to attack Web applications, and new methods constantly emerge. Web applications attacks can cost organizations time and money and lead to expensive and embarrassing data security breaches, making thorough defense strategies and mechanisms imperative for every organization.
This learning guide will reveal more about Web application attacks and security, how to identity different types of attacks, including cross-site scripting, and offer advice on how to prevent and implement Web application defense strategies.
scripting vulnerability penetration testing
In this expert response, Russell Dean Vines discusses how to test a Web application for cross-site scripting vulnerabilities, how to perform penetration testing for XSS and what type of code would exhibit XSS threats.
scripting explained: How to prevent XSS attacks
In this comprehensive tip, brought to you by SearchSecurity.co.UK, expert Michael Cobb offers advice on everything you need to know about detecting and preventing the Web application attack that refuses to go away: cross-site scripting.
Here, security professionals can learn how to prevent XSS attacks and protect applications that are vulnerable to cross-site scripting by using a security development lifecycle, client-side validation, automatic source code scanning tools, cross boundaries policies and security encoding libraries.
This was first published in April 2011