Chapter 1
Security Operations
Course: Comptia Cysa Cso 003
Subject: Comptia Cysa Plus Cso 003
Chapter: Vulnerability Management
Effective cybersecurity requires implementing proactive controls to mitigate risks associated with various software vulnerabilities and attack vectors.
1. Cross-Site Scripting (XSS)
Cross-site scripting (XSS) is a common security vulnerability in web applications that enables attackers to inject malicious client-side scripts (typically JavaScript) into web pages viewed by other users. Successful XSS attacks can lead to session hijacking, stealing of sensitive information, phishing attacks, unauthorized actions, or website defacement.
Types of XSS Attacks
XSS attacks are categorized primarily into:
- Reflected XSS
- Persistent (Stored) XSS
- DOM-based XSS (client-side only; for completeness)
A. Reflected Cross-site Scripting (Reflected XSS)
Definition:
Reflected XSS occurs when malicious scripts provided by attackers are reflected immediately back to the victim’s browser via server responses, typically through URLs or form inputs without proper sanitization.