Almost 50% of web pages infected with DOM-based XSS. Learn How it is exploited

https://journal.hexmos.com/domxss/?src=hn

by R41 • 2 years ago

13 3 2 years ago

journal.hexmos.com

tailspin2019• 2 years ago

If the author is here could I make a gentle suggestion to change “infected with” to something like “potentially vulnerable to”.

“Infected” means something very specific and I think its usage in this case comes off as a bit clickbaity and detracts from the credibility of the article.

The article referenced as the source of that statistic uses more accurate wording (though doesn’t cite its own sources):

According to various research and studies, up to 50% of websites are vulnerable to DOM Based XSS vulnerabilities.

Also, “Almost 50%” != “up to 50%”

ptx• 2 years ago

Whenever anything is sent to the server from the browser, we need proper validation. Input should be properly sanitized before being sent to the server.

That doesn't sound right. If the attack vector is reflected XSS, i.e. that code (HTML/JS/etc.) is taken from the attacker's input, stored in the database by the server and later injected straight into another user's page, sanitizing it "before being sent to the server" would mean relying on the attacker helpfully sanitizing their own data.

damiankennedy• 2 years ago

I read this to mean sanitized in a gateway type layer.

Almost 50% of web pages infected with DOM-based XSS. Learn How it is exploited

Related Stories