Cross-site scripting occurs when untrusted content reaches a browser without the right context-specific handling. Developers and testers compare XSS variants and attacker techniques, examine why browser context matters, and apply contextual output encoding to reduce the chance that content runs as executable script.

Participants of this module will…

• Learn the variants of XSS vulnerabilities
• Realize the many types of exploits that can be carried out using XSS
• Understand the importance of the browser context from both the attacker’s perspective and the developer’s perspective
• Learn how to mitigate XSS vulnerabilities by using contextual output encoding.