LEARNING PATH: Application Security Essentials

Cross-Site-Scripting Attack and Defense

Client-side attacks are totally different from server-side ones, because they rely on the attack being initiated from the user’s device. It creates a whole new set of problems for security teams to deal with, and developers need to change their remediation strategies, too. 

In this course, we take an exclusive look at Cross-Site Scripting (XSS) attacks, and why they’re such a big deal. We start with an introduction to client-side attacks, and how they evolved from the time of MySpace malware. You’ll learn about the different kinds of the XSS attacks as well as the most popular strategies and exploits used by attackers. 

In the next couple of modules, we take the help of hands-on lab exercises to simulate and run XSS attacks on applications. We follow this up with a defensive countermeasure using tried-and-tested methods for securing apps against these attacks. 

A majority of your learning will be done practically, using labs to simulate realistic environments. This gives you an opportunity to  learn first-hand the actual AppSec strategies you’ll be using to secure web applications. By the end of this course, you’ll have an in-depth, hands-on knowledge of how Cross-Site Scripting works, and how to deal with real-world attack scenarios.

Cross-Site-Scripting Attack and Defense
Proficiency Beginner
Audience Application Security
Course Duration​ 4
Lessons​ 19
Cloud Labs​ 5



Cloud Security Expert

Course duration




Cloud Labs


    • The Same-Origin Policy and what it means to the browser
    • What is Cross-Site Scripting (XSS)?
    • The Evolution of XSS: 
      • The Myspace Samy worm
      • Targeted XSS Attacks
      • Ad Networks and Cryptomining Attacks
      • Magecart
    • Why does Cross-Site Scripting happen?
    • Types of XSS
      • Reflected
      • Persistent
      • DOM-Based
    • Labs: Types of Cross-Site Scripting
    • Effects and Impacts of XSS
    • XSS Defense – Keystone Concepts
    • Challenges with output escaping 
    • Context-driven output escaping
    • Lab: Output Escaping
    • Lab: DOMPurify
    • The Browser is your friend. Use them
    • Browser security directives that prevent against XSS
    • Browser Security headers like HTTPOnly, SameSite, etc. 
    • Content-Security-Policy and its utility against XSS
    • Lab: Content-Security Policy Deep-dive
  • Understanding Content-Security-Policy
  • Input Validation - Request Filter
  • Input Validation - JSON Schema
We use cookies on our website to give you the most relevant experience by remembering your preferences and repeat visits. By clicking "Accept" you consent to the use of All the cookies