In the previous lectures, we saw what the successes and also see how to exploit the vulnerability,
but being a security expert, we should also know how to prevent such attacks.
This course is not only about hacking and exploiting vulnerabilities, but we are also willing to tell
you how to prevent those attacks.
So the first measure to prevent excesses is user input.
Escaping the first method you can and you should use to prevent excessive vulnerabilities from appearing
in your applications is by escaping user input.
Escaping data means taking the data and application has received and ensuring it's secure before rendering
it for the end user by ISP escaping user input.
Key characters in data received by a webpage will be prevented from being interpreted in any malicious.
If your page doesn't allow users to add their own code to the page, a good rule of thumb is to then
escape any and all the admin JavaScript entities.
Then.
Then the next major can be validating input.
The theory goes like this.
Expect any untrusted data to be malicious.
What's untrusted data now?
Validating input is the process of ensuring an application is rendering the correct data and preventing
malicious data from doing harm to the site database or users.
While listing and input validation are more commonly associated with a injection, they can also be
used as an additional method of prevention for Exercice.
Then, is satellite data the third way or the most important way to prevent cross site scripting attacks
is to sanitize user input?
We saw how the code was removing the HTML tags and script entities from the input that we had supplied
to local sanitizing data is a strong defense, but should not be used alone to battle Xerces attack.
It's totally possible you will find the need to use all the three methods which I have discussed earlier.
Then is the not trust anything that is used content security policy, which means do not trust what
user is inputting.
You have to check each and every form of character that user is inputting in your input box.
The last one is content security policy, which means as a last line of defense, you can use the Content
Security Policy CSP to reduce the severity of any vulnerabilities that still occur.
If you want to read more about CSP, we have attached a book called Ethical Hacker Playbook in which
it is explained what is the USP, what is accesses and other prevention methods.
Indeed, I hope this was this.
Lectures were a brief introduction and also gave you a clear idea of exercice and also give you techniques
for exploiting Exercice.
Now the most common question is how common are Accessors attacks?
That is difficult to get reliable data about real world exercice attacks, but it is probably less frequently
exploited than other vulnerabilities.
And again, one of the main question is what is the difference between exercise and SQL injection?
Since in both cases user is inputting a call.
Now, exercise is the client side of vulnerability that targets other applications.
User while esquibel injection is a server side of vulnerability that target the applications database.
This was all for this lecture.
And in the next lecture we will start with another new topic that is cross site request forgery.