Client-side flaws: XSS, IDOR and authentication defence
XSS, session and access-control mistakes and their fixes.
Level 301 · 17 lessons · 15 practice labs
Lessons
XSS
- What XSS is and why it happens: You will understand that XSS is user-supplied text running as code in a page, and why it happens.
- Stored versus reflected XSS: differences and detection: You will learn the difference between stored and reflected XSS, where each one appears, and how to detect them in logs.
- DOM-based XSS: handling data safely in browser scripts: You will find places where page JavaScript writes data from the address bar into unsafe spots and replace them with safe methods.
- Closing XSS with output encoding: You will apply output encoding in your own code and see how showing data as harmless text closes XSS.
- Content Security Policy and cookie flags: You will learn and set up how a Content Security Policy (CSP) and cookie flags limit the damage even if a flaw exists.
- Short task: close the stored XSS in the lab app and add a second layer with CSP
Request forgery and access
- CSRF: preventing request forgery with tokens and SameSite cookies: You will understand requests sent without the user knowing, and prevent them with form tokens and SameSite cookie settings.
- Access control and closing IDOR: You will set up server-side access control that stops a user reaching someone else's data just by changing a number.
- Token-based API authentication: You will learn how token-based API authentication works and how to manage the lifetime, scope and storage of tokens safely.
- Short task: evidence and close one IDOR and one CSRF flaw
Authentication
- Protecting a login form: rate limits and checks: You will protect a login form with rate limits and extra checks, and learn which measures help against account takeover.
- Session management: You will learn how sessions are created, how to limit their lifetime and how to end them safely on logout.
- Building a safe password reset flow: single-use, expiring links: You will make password reset links unpredictable, single-use and short-lived, and verify the whole flow with tests.
- Short task: make the password reset link single-use and expiring
Chains
- Chained weaknesses and defence in depth: You will see how small weaknesses combine into a big problem, and how layered defence stops that.
- Following a chained attack step by step in logs
- Capstone: a client-side and authentication review: In the capstone you will review a fictional company's web application for XSS, session and access-control mistakes and report fix recommendations.
Practice labs
- Close a stored XSS and add CSP: Close the stored XSS in product reviews with output encoding and add a strict CSP as a second layer.
- DOM XSS: from a URL parameter to script: Prove the script on the redirect page handles a URL parameter unsafely and rewrite it with a safe API.
- A non-HttpOnly session cookie and XSS: Show in the lab that an XSS can read the session cookie, fix the cookie flags and close the XSS too.
- Stored and reflected: one field, two paths: Show one input causes reflected XSS on one page and stored XSS on another and close both with a shared output helper.
- CSRF and IDOR in profile deletion: Prove profile deletion is open to both CSRF and ID tampering and close the two flaws together.
- Validating the API token in the wrong place: Prove an endpoint checks only that a token exists, not whose it is, and complete the validation.
- A SameSite setting and a token together: Apply a token and SameSite=Lax together in an app without a SameSite setting and show each layer works on its own.
- Horizontal privilege escalation in a message archive: Prove other users' messages are reachable by conversation ID in the message archive API and add a participant check in the data layer.
- A login form with no rate limit: Prove the login form accepts unlimited attempts and add per-IP and per-account limits.
- A reset link that can be reused: Show the password reset link works more than once and never expires and make it single-use and time-limited.
- The reset token leaks in a response: Find the reset token returned in the reset request response, remove it and add a test that catches this leak.
- Three session management weaknesses: Find the fixation, long-lifetime and logout weaknesses in an app, close all three and prove it with a retest.
- Follow a chained attack in the logs: Lay out on a timeline, step by step, a chain in web and app logs that starts with XSS and ends with privilege escalation.
- Break the chain at the cheapest link: Assess the fix cost of each link in a three-link attack chain and apply the fix that breaks the chain fastest.
- Client-side and identity review: Ostria Forum: Review the fictional Ostria Forum for XSS, CSRF, IDOR and session weaknesses, close them and document the defence-in-depth layers.
About this course
XSS, session and access-control mistakes and their fixes.
What you will learn
- XSS
- Request forgery and access
- Authentication
- Chains
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.