Discussion on: How TF Does XSS Work?

[Ben Halpern]

Ah, I just replied to you on Twitter, but I’m glad you posted here because it will help others.

Here was my Twitter reply:

Ben Halpern 🤗

@bendhalpern

@TiffanyW_412 XSS typically refers to JavaScript included in the HTML another user will load. Say if, instead of encoding and parsing <script>alert("hello")</script>, Twitter actually evaluated it.

Twitter cleanses all text and makes sure the browser doesn’t treat it like HTML.

00:24 AM - 12 Nov 2018

02

And here’s that scenario in practice:

My All-Time Favorite Demonstration of a Cross-Site Scripting Attack

Ben Halpern

#xss#security#javascript#html

[tiff]

Thanks Ben. Reading up on it some more.

[Ben Halpern]

Awesome. Other folks might be able to add other explanations or analogies which could add more color.