Contents
What is the main difference between a server-side Exploitation and client-side Exploitation?
An example of the client/server architecture is the web, where a web server communicates with a web browser (the client). A client-side exploit is thus one which attacks or influences the client. It is distinguished from a server-side exploit which attacks the server.
What is XSS and why is it bad?
Cross-site scripting (also known as XSS) is a web security vulnerability that allows an attacker to compromise the interactions that users have with a vulnerable application. It allows an attacker to circumvent the same origin policy, which is designed to segregate different websites from each other.
Can you have server XSS and client XSS?
As such, you can have both Reflected Server XSS and Stored Server XSS. In this case, the entire vulnerability is in server-side code, and the browser is simply rendering the response and executing any valid script embedded in it. Client XSS occurs when untrusted user supplied data is used to update the DOM with an unsafe JavaScript call.
Is the XSS Bug a server side or client side vulnerability?
The terminology is a little slippery, but usually an “XSS bug” is a client-side exploit of a server-side vulnerability. Cross-site scripting is not, in and of itself, a security problem. The problem is that it can happen without the end user’s knowledge.
Can you have both reflected and stored XSS?
As such, you can have both Reflected Client XSS and Stored Client XSS. With these new definitions, the definition of DOM Based XSS doesn’t change. DOM Based XSS is simply a subset of Client XSS, where the source of the data is somewhere in the DOM, rather than from the Server.
What does XSS mean for a web application?
An XSS is room for the attacker, as you have seen quite a bit of it. Attacker-controlled code, which runs within the context of the web application on the client side, has full control over what the client does and can also read the DOM of the HTML page, etc.