Let's quickly talk about preventing cross site scripting.
So how might we prevent cross-eyed scripting.
Well there's a few different ways and this isn't even everything.
Well let's talk about this.
So first we have encoding now encoding is converting a control character to its escape sequence.
OK.
So for example here you see that we have the less than symbol becomes the ampersand L T and then a semicolon.
So if we had script then script would just become Ampersand LTE semicolons script etc. you see the example.
OK.
So we're doing that.
So that these symbols are not interpreted for like example an Excel tag or in this situation the script
itself.
You just can't interpret it.
We can't use that character anymore.
Right.
And that's a very common way of doing things.
Another thing is filtering so where you just take script and you strip out everything and anything and
then just becomes script.
So any of those characters that you don't want in there they just get wiped out basically.
Right.
So we say hey we don't want that.
We're going to take it out.
Another one is validating.
So that's comparing inputting it's like a white list or a set of known good numbers.
Say for example you have an account number and you type in the account number well if the account number
is not in a set of known good numbers then it's not going to validate and it's going to prevent that
from even reaching server side right or reaching an attack level.
And then lastly there's sanitization which is basically a combination of everything and that's really
what you're after is this combination of encoding filtering validating and making sure that this malicious
activity and malicious code cannot be injected into your Web site so special note goes out to the H
TTP only flag.
So if you've been paying attention and birth sweet and looking at your cookies when your cookies get
set a cookie can have an HP only flag and a secure flag.
We're curious more for cross site scripting about the TTP only flag because its purpose is to prevent
cookies from actually being observed by unauthorized parties.
OK.
So what that means is if we do a javascript and we try to steal cookie via javascript if we have the
HP only flag we're not going to be able to see that cookie.
We'll steal that cookie.
So that will also help prevent this.
So there's a bunch of different things that we can do and help guide this long.
There's also headers out there that are a cross site scripting best practice headers that we can utilize
to help prevent this as well.
A lot of modern browsers are starting to help out here and prevent these.
So this is a very very common exploit that you see and I would say out of all the things I have found
the most bugs on it's probably cross site scripting level would be up there on the number one for me.
So you'll see this all the time.
So that is it for cross-eyed scripting.
Hopefully you learned a bit here and you know you just take away the big takeaways are what it does
why it's malicious and the three types of cross-eyed scripting which are reflected stored and done based.
So from here we're going to talk a high level of insecure D serialization in the next video which is
number eight on our list.
We've only got three more to go so I will see over in the next video.