Contents
Overview    3
What are Personas    4
Business Decision Maker    4
Architect    4
Developer    4
Tester/QA    4
Understanding XSS for the Business Decision Maker    5
Risk    5
Business Impact    5
Fixing the Code    6
Resources and Training for Business Decision Makers    6
Understanding XSS for the Architect    6
Identifying the Problem    6
Common XSS Attacks    7
Designing a Fix    7
Input Validation Rules    8
Output Encoding Rules    8
Future Design Considerations    8
Tools for Designing Software That Prevents XSS    9
Resources and Training for Architects/PMs    9
Understanding XSS for the Developer    9
Identifying XSS Exploits    9
Identifying Untrusted Input    10
Identifying Untrusted Output    10
Stealing Cookies and User Information    11
Writing Secure Code    11
Validating Untrusted Input    11
An Alternative Approach: Sanitize Untrusted Input    12
Validating Trusted Output    13
Protecting Cookies and User Information from XSS    13
Use ValidateRequest    14
Tools and Libraries    14
Resources and Training for Developers    14
Understanding XSS for the Tester/QA    15
Identifying Insecure Code    15
Map Out the Site and Its Functionality    16
Identify and List Out Every Point of User-Supplied Input    16
Start Testing and Pay Attention to the Output    16
Verifying Security Against XSS Attacks    16
Modifying Your Test Process for XSS    17
Tools You Can Use    17
Resources and Training for Testers    18
The Microsoft SDL and Preventing XSS    18
Long-Term Solutions    18
Conclusion    19
Acknowledgements    19


You would..
Share
Related Documents
  1. Putting Security Into Your Virtual World (536)
  2. Security Testing Reference : SQL Injection (2163)
  3. Security Testing White Papers : Retina (1089)
  4. [Free] WebGoat : Security Testing Tool (2025)
  5. [Free] BFBTester : Brute Force Binary Tester (1651)
  6. [Video] Software Security Testing: Strengthening Your Defense Strategy (765)
  7. [Security Testing] Hacker's Cross Site Scripting Attack (XSS vulnerabilities) (1495)
  8. [Free] LAPSE : Web Application Security Scanner for Java (3106)
  9. [Free] x5s : XSS security testing assistant tool (1741)
  10. [Video] Take Control of your IT Security and Compliance without the Complexity of Traditional SIM Systems (825)
  11. Using JTest for Security Testing (1877)
  12. [Ebook] Google Hacks : 2nd Edition (2282)
  13. [Ebook] Linux 101 Hacks (2350)
  14. Steps to do security testing (1618)
  15. [Free] Exploit-Me : Web application security testing tools (2776)
  16. [Free] Security Software Testing Suite (SSTS) : Application-based security testing (1523)
  17. New Advanced SQL Injection For Advanced Security Testing (1709)
  18. CSO Magazine : Software Risk and Security (734)
  19. [Ebook] Hacker Attack (2394)
  20. 2010-10-27, SecureWorld Expo @ USA (1370)