Beginner LevelWeb Security & Cyber Defense
What are the 3 types of XSS (Stored, Reflected, DOM-based) and how do they differ?
❓ Interview Prompt: Explain Stored XSS, Reflected XSS, DOM-based XSS, execution contexts, and sanitization techniques.
Cross-Site Scripting (XSS) allows attackers to execute malicious JavaScript inside victim browsers:
3 Primary XSS Types:
1
Stored XSS (Persistent - Most Dangerous): Malicious script is saved in the database (e.g. comment field). Every user loading the page executes the script.
2
Reflected XSS (Non-Persistent): Script is included in a URL query parameter ('http://site.com/search?q=<script>...') and reflected immediately in the server HTML response.
3
DOM-based XSS: Vulnerability exists purely in client-side JS. Script executes when JS reads from an untrusted Source ('location.hash') and passes it to an unsafe Sink ('element.innerHTML' or 'eval()').
Code Implementation Example
typescript
// ❌ DOM-based XSS Sink Vulnerability:
const searchHash = location.hash.substring(1);
document.getElementById('results')!.innerHTML = searchHash; // Executes malicious script!
// ✅ Secure DOM Output Encoding:
document.getElementById('results')!.textContent = searchHash; // Safe text literal!💡DOM-based XSS sink vulnerability vs secure textContent output encoding.
🎯 Interview Key Takeaway
Use textContent or innerText instead of innerHTML to prevent client-side DOM XSS vulnerabilities.
#XSS#DOM-XSS#OWASP#Security#Beginner
Back to all Web Security & Cyber Defense Questions→