diff --git a/app/views/layouts/tutorial/xss/_xss_first.html.erb b/app/views/layouts/tutorial/xss/_xss_first.html.erb new file mode 100644 index 0000000..ae77a52 --- /dev/null +++ b/app/views/layouts/tutorial/xss/_xss_first.html.erb @@ -0,0 +1,81 @@ +
+
+
+ A2 - Cross-Site Scripting ("XSS") +
+
+
+
+
+
+ + + + Description + +
+
+
+

XSS flaws occur whenever an application takes untrusted data and sends it to a web browser without proper validation and escaping. XSS allows attackers to execute scripts in the victim’s browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites.

+
+
+
+
+
+ + + + Bug + +
+
+
+

Stored Cross-Site Scripting - The following code was taken from app/views/layouts/shared/_header.html.erb

+ +

+ 

+					  <%= @code %>
+
+

+ +
+
+
+
+
+ + + + Solution + +
+
+
+

Stored Cross-Site Scripting ATTACK:

+ +

When registering, enter your JavaScript tag such as <%= %{