{"id":7635,"date":"2017-10-17T15:39:58","date_gmt":"2017-10-17T15:39:58","guid":{"rendered":"http:\/\/blog.nsfocusglobal.com\/?p=887"},"modified":"2025-07-09T07:15:58","modified_gmt":"2025-07-09T07:15:58","slug":"a-step-further-demystifying-xss","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/a-step-further-demystifying-xss\/","title":{"rendered":"A Step Further \u2014 Demystifying XSS"},"content":{"rendered":"<h1><\/h1>\n<p><a href=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/XSS.jpg\"><img fetchpriority=\"high\" decoding=\"async\" class=\"size-full wp-image-908 aligncenter\" src=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/XSS.jpg\" alt=\"\" width=\"500\" height=\"210\" \/><\/a><\/p>\n<p>Here is a comprehensive tutorial on cross-site scripting (XSS) attacks, ranging from entry to practice.<\/p>\n<h2><strong>Overview<\/strong><\/h2>\n<p><a href=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/XSS-Classification.png\"><img decoding=\"async\" class=\"size-full wp-image-907 aligncenter\" src=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/XSS-Classification.png\" alt=\"\" width=\"554\" height=\"382\" \/><\/a><\/p>\n<p>Note that XSS attacks are classified according to different angles in the preceding figure, but not simply classified into reflective XSS, stored XSS, and DOM-based XSS.<\/p>\n<p>In essence, XSS is injection of HTML code and JavaScript code. This kind of attacks is often not taken seriously by developers as it targets the browser side which is equivalent to the client side.<\/p>\n<p>Regular XSS attacks can be detected with a simple method: If a complete parameter or part of a parameter typed by a user is included in the source code, an XSS vulnerability is deemed to exist.<\/p>\n<p><a href=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/20171017113825.png\"><img decoding=\"async\" class=\"size-full wp-image-888 aligncenter\" src=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/20171017113825.png\" alt=\"\" width=\"554\" height=\"210\" \/><\/a><\/p>\n<p>We can use a scanner to get rid of most regular XSS attacks as the scanner is good at\u00a0pattern recognition and can easily find the characters that we just typed in HTML code.<\/p>\n<p><a href=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/Detect-XSS-with-scanner.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-893 aligncenter\" src=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/Detect-XSS-with-scanner.png\" alt=\"\" width=\"622\" height=\"561\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p>Until one day, a type of XSS attacks without any trace in source code emerged. It turns out that XSS attacks may not be as simple as we thought.<\/p>\n<p><a href=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/20171017114051.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-889 aligncenter\" src=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/20171017114051.png\" alt=\"\" width=\"509\" height=\"370\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<h2>About Document Object Model<\/h2>\n<h3>Document Object Model<\/h3>\n<p>Document Object Model (DOM) is a well-known programing API.<\/p>\n<p>DOM is a method that presents page elements in the form of objects in a tree-like hierarchy to facilitate the handling by JavaScript.<\/p>\n<p><a href=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/DOM.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-894 aligncenter\" src=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/DOM.png\" alt=\"\" width=\"554\" height=\"271\" srcset=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/DOM.png 554w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/DOM-300x147.png 300w\" sizes=\"(max-width: 554px) 100vw, 554px\" \/><\/a><\/p>\n<h3>Common DOM Method<\/h3>\n<p>Users can access HTML DOM through JavaScript (and other programming languages). All HTML elements are defined as objects for which the HTML DOM API defines methods and attributes.<\/p>\n<p><a href=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/common-DOM-method.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-892 aligncenter\" src=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/common-DOM-method.png\" alt=\"\" width=\"554\" height=\"375\" \/><\/a><\/p>\n<h3>Four Important DOM Properties<\/h3>\n<p><strong>nodeName<\/strong>: specifies the name of a node.<\/p>\n<ul>\n<li>This property is read-only.<\/li>\n<li>For an element node, the value of this property is the same as the tag name of the node.<\/li>\n<li>For an attribute node, the value of nodeName is the name of the node.<\/li>\n<li>For a text node, the value of this property is always <strong>#text<\/strong>.<\/li>\n<li>For a document node, the value of this property is always <strong>#document<\/strong>.<\/li>\n<\/ul>\n<p><strong>nodeValue<\/strong>: specifies the value of a node.<\/p>\n<ul>\n<li>For an element node, the value of this property is <strong>undefined<\/strong> or <strong>null<\/strong>.<\/li>\n<li>For a text node, the value of this property is the text content.<\/li>\n<li>For an attribute node, the value of nodeValue is the same as the value of the attribute node.<\/li>\n<\/ul>\n<p><strong>nodeType<\/strong>: specifies the node type.<\/p>\n<ul>\n<li>This property is read-only.<\/li>\n<\/ul>\n<p><strong>innerHTML<\/strong>: gets the element content<strong>.<\/strong> The following figure is an example of this property.<\/p>\n<p><a href=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/innerHTML.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-large wp-image-909 aligncenter\" src=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/innerHTML.png\" alt=\"\" width=\"640\" height=\"248\" \/><\/a><\/p>\n<p>The element content is Hello World!.<\/p>\n<p>This property can be read and assigned a value, and therefore it is the most referenced object property and also most vulnerable to security issues.<\/p>\n<h3>Where Is the Input?<\/h3>\n<p><strong>Properties of the location object<\/strong><\/p>\n<p><a href=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/Properties-of-location-object.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-902 aligncenter\" src=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/Properties-of-location-object.png\" alt=\"\" width=\"554\" height=\"245\" \/><\/a><\/p>\n<p>JavaScript usually obtains the user-supplied input by invoking the location object built in the DOM, such as getting a parameter fragment by using location.search or getting a complete URL by using location.href.<\/p>\n<h2><a href=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/20171017114259.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-891 aligncenter\" src=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/20171017114259.png\" alt=\"\" width=\"470\" height=\"397\" \/><\/a>DOM-based XSS<\/h2>\n<h3>Two Typical DOM Procedures<\/h3>\n<p><strong>(1) Reflected DOM-based XSS<\/strong><\/p>\n<p><a href=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/Reflected-DOM-based-XSS.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-903 aligncenter\" src=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/Reflected-DOM-based-XSS.png\" alt=\"\" width=\"456\" height=\"310\" \/><\/a><\/p>\n<p><strong>(2) Stored DOM-based XSS<\/strong><\/p>\n<p><a href=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/Stored-DOM-based-XSS.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-906 aligncenter\" src=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/Stored-DOM-based-XSS.png\" alt=\"\" width=\"554\" height=\"242\" srcset=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/Stored-DOM-based-XSS.png 554w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/Stored-DOM-based-XSS-300x131.png 300w\" sizes=\"(max-width: 554px) 100vw, 554px\" \/><\/a><\/p>\n<h3>Required Knowledge<\/h3>\n<p><a href=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/Required-Knowledge.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-904 aligncenter\" src=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/Required-Knowledge.png\" alt=\"\" width=\"551\" height=\"257\" \/><\/a><\/p>\n<p>Compared with common XSS, DOM-based XSS is discovered in a way like code audits.<\/p>\n<h3>Typical DOM-based XSS Examples<\/h3>\n<p><a href=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/Example-1.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-895 aligncenter\" src=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/Example-1.png\" alt=\"\" width=\"910\" height=\"499\" \/><\/a><\/p>\n<p><a href=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/Example-2.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-896\" src=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/Example-2.png\" alt=\"\" width=\"917\" height=\"484\" \/><\/a><\/p>\n<h3>mXSS<\/h3>\n<p>If user input goes in and out of DOM more than twice, a more advanced type of DOM-based XSS may be triggered: mutated XSS (mXSS).<\/p>\n<p><a href=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/mXSS.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-901 aligncenter\" src=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/mXSS.png\" alt=\"\" width=\"798\" height=\"429\" \/><\/a><\/p>\n<h3>Scenario Inclinable to mXSS<\/h3>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-911 aligncenter\" src=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/Scenario-Inclinable-to-mXSS.png\" alt=\"\" width=\"858\" height=\"172\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>As innerHTML can unescape HTML entities, CSS escape characters, and ANSI escape codes, the user-supplied input that has been escaped and therefore is deemed to be secure will probably be unescaped upon filter bypassing.<\/p>\n<p><a href=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/script.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-905 aligncenter\" src=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/script.png\" alt=\"\" width=\"693\" height=\"540\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<h2>Filter Bypassing<\/h2>\n<h3>Examples<\/h3>\n<p>The following are two examples of filter bypassing in common XSS.<\/p>\n<p><a href=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/filter-bypassing-in-common-XSS-example-1.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-897 aligncenter\" src=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/filter-bypassing-in-common-XSS-example-1.png\" alt=\"\" width=\"590\" height=\"511\" \/><\/a><\/p>\n<p><a href=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/filter-bypassing-in-common-XSS-example-2.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-898 aligncenter\" src=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/filter-bypassing-in-common-XSS-example-2.png\" alt=\"\" width=\"843\" height=\"483\" \/><\/a><\/p>\n<h3>Filter Bypassing Method<\/h3>\n<p><a href=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/Filter-bypassing-method.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-899 aligncenter\" src=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/Filter-bypassing-method.png\" alt=\"\" width=\"552\" height=\"258\" \/><\/a><\/p>\n<p>Generally, DOM-based XSS should first survive the cleaning by the filter on the server side and then the JavaScript loaded on the page. Therefore, it is no easy job to bypass the filter.<\/p>\n<p><strong>Code bypassing:<\/strong><\/p>\n<p>Code to be inserted: &lt;img src=\u201c\u201d onerror=alert(123)&gt;<\/p>\n<ul>\n<li>Replace double quotation marks with HTML entities: &lt;img src=\u201c\u201d onerror=alert(123)&gt;<\/li>\n<li>Replace angle brackets with CSS\/JS codes (Unicode): \\u003cimg src=\u201c\u201d onerror=alert(123)\\u003e<\/li>\n<li>Replace parenthesis with CSS\/JS codes (Base16): \\x28\\x29&lt;img src=\u201c\u201d onerror=alert\\x28123\\x29&gt;<\/li>\n<li>Replace all characters with String.fromCharCode methods: fromCharCode(60,105,109,103,32,115,114,99,61,34,34,32,111,110,101,114,114,111,114,61,97,108,101,114,116,40,49,50,51,41,62)<\/li>\n<li>Replace &#8220;er&#8221; at a certain place with ANSI code: &lt;img src=\u201c\u201d onerror=al%65%72t(123)&gt;<\/li>\n<\/ul>\n<p><strong>HTML5 features:<\/strong><\/p>\n<p><a href=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/H5-features-1.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-912 aligncenter\" src=\"https:\/\/staging.nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/H5-features-1.png\" alt=\"\" width=\"877\" height=\"439\" \/><\/a><\/p>\n<h3>Recommendations for DOM-based XSS Prevention<\/h3>\n<p><strong>Sites that do not have a rich text editor (custom style) and do not use DOM:<\/strong><\/p>\n<ul>\n<li>Input: Sanitize input for double quotation marks, single quotation marks, left and right angle brackets, and semicolons.<\/li>\n<li>Output: Convert characters to HTML entities.<\/li>\n<\/ul>\n<p><strong>Sites that do not have a rich text editor (custom style) but use DOM:<\/strong><\/p>\n<ul>\n<li>Input: Escape double quotation marks, single quotation marks, left and right angle brackets, and semicolons in DOM.<\/li>\n<li>Output: Encode characters before they are output, for example, innerHTML=encodeHTML(output).<\/li>\n<\/ul>\n<p><strong>Sites that have a rich text editor (custom style) but do not use DOM:<\/strong><\/p>\n<ul>\n<li>Input: Sanitize input for double quotation marks, single quotation marks, and semicolons.<\/li>\n<li>Output: Convert characters to HTML entities.<\/li>\n<\/ul>\n<p><strong>Sites that have a rich text editor (custom style) and use DOM:<\/strong><\/p>\n<p>In this scenario, no preventive measures are available. What we can do is post-event remediation.<\/p>\n<h2>Reference Links<\/h2>\n<ul>\n<li>http:\/\/sandbox.host.smartgslb.com<\/li>\n<li>http:\/\/html5sec.org\/<\/li>\n<li>http:\/\/drops.wooyun.org\/tips\/956<\/li>\n<li>http:\/\/www.w3school.com.cn\/<\/li>\n<li>http:\/\/www.slideshare.net\/x00mario\/the-innerhtml-apocalypse<\/li>\n<li>http:\/\/app.baidu.com\/app\/enter?appid=280383<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Here is a comprehensive tutorial on cross-site scripting (XSS) attacks, ranging from entry to practice. Overview Note that XSS attacks are classified according to different angles in the preceding figure, but not simply classified into reflective XSS, stored XSS, and DOM-based XSS. In essence, XSS is injection of HTML code and JavaScript code. This kind [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":35814,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_coblocks_attr":"","_coblocks_dimensions":"","_coblocks_responsive_height":"","_coblocks_accordion_ie_support":"","footnotes":""},"categories":[3,15],"tags":[447,738,766],"class_list":["post-7635","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","category-research-reports","tag-html5","tag-web","tag-xss"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>A Step Further \u2014 Demystifying XSS - NSFOCUS<\/title>\n<meta name=\"robots\" content=\"noindex, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"pt_BR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"A Step Further \u2014 Demystifying XSS - NSFOCUS\" \/>\n<meta property=\"og:description\" content=\"Here is a comprehensive tutorial on cross-site scripting (XSS) attacks, ranging from entry to practice. Overview Note that XSS attacks are classified\" \/>\n<meta property=\"og:url\" content=\"https:\/\/nsfocusglobal.com\/a-step-further-demystifying-xss\/\" \/>\n<meta property=\"og:site_name\" content=\"NSFOCUS\" \/>\n<meta property=\"article:published_time\" content=\"2017-10-17T15:39:58+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-07-09T07:15:58+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/XSS-1.jpg\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"A Step Further \u2014 Demystifying XSS - NSFOCUS\" \/>\n<meta name=\"twitter:description\" content=\"Here is a comprehensive tutorial on cross-site scripting (XSS) attacks, ranging from entry to practice. Overview Note that XSS attacks are classified\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/XSS-1.jpg\" \/>\n<meta name=\"twitter:label1\" content=\"Escrito por\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. tempo de leitura\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/a-step-further-demystifying-xss\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/a-step-further-demystifying-xss\\\/\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/#\\\/schema\\\/person\\\/fd9ab61c9c77a81bbd870f725cc0c61d\"},\"headline\":\"A Step Further \u2014 Demystifying XSS\",\"datePublished\":\"2017-10-17T15:39:58+00:00\",\"dateModified\":\"2025-07-09T07:15:58+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/a-step-further-demystifying-xss\\\/\"},\"wordCount\":887,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/a-step-further-demystifying-xss\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2017\\\/10\\\/XSS-1.jpg\",\"keywords\":[\"HTML5\",\"Web\",\"XSS\"],\"articleSection\":[\"Blog\",\"Research &amp; Reports\"],\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/nsfocusglobal.com\\\/a-step-further-demystifying-xss\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/a-step-further-demystifying-xss\\\/\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/a-step-further-demystifying-xss\\\/\",\"name\":\"A Step Further \u2014 Demystifying XSS - NSFOCUS\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/a-step-further-demystifying-xss\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/a-step-further-demystifying-xss\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2017\\\/10\\\/XSS-1.jpg\",\"datePublished\":\"2017-10-17T15:39:58+00:00\",\"dateModified\":\"2025-07-09T07:15:58+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/a-step-further-demystifying-xss\\\/#breadcrumb\"},\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/nsfocusglobal.com\\\/a-step-further-demystifying-xss\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/a-step-further-demystifying-xss\\\/#primaryimage\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2017\\\/10\\\/XSS-1.jpg\",\"contentUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2017\\\/10\\\/XSS-1.jpg\",\"width\":500,\"height\":210,\"caption\":\"XSS acronym for Cross Site Scripting.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/a-step-further-demystifying-xss\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/nsfocusglobal.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"A Step Further \u2014 Demystifying XSS\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/#website\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/\",\"name\":\"NSFOCUS\",\"description\":\"Security Made Smart and Simple\",\"publisher\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"pt-BR\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/#organization\",\"name\":\"NSFOCUS\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2024\\\/08\\\/logo-ns.png\",\"contentUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2024\\\/08\\\/logo-ns.png\",\"width\":248,\"height\":36,\"caption\":\"NSFOCUS\"},\"image\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/#\\\/schema\\\/person\\\/fd9ab61c9c77a81bbd870f725cc0c61d\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g\",\"caption\":\"admin\"},\"sameAs\":[\"https:\\\/\\\/nsfocusglobal.com\"],\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/author\\\/admin\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"A Step Further \u2014 Demystifying XSS - NSFOCUS","robots":{"index":"noindex","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"pt_BR","og_type":"article","og_title":"A Step Further \u2014 Demystifying XSS - NSFOCUS","og_description":"Here is a comprehensive tutorial on cross-site scripting (XSS) attacks, ranging from entry to practice. Overview Note that XSS attacks are classified","og_url":"https:\/\/nsfocusglobal.com\/a-step-further-demystifying-xss\/","og_site_name":"NSFOCUS","article_published_time":"2017-10-17T15:39:58+00:00","article_modified_time":"2025-07-09T07:15:58+00:00","og_image":[{"url":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/XSS-1.jpg","type":"","width":"","height":""}],"author":"admin","twitter_card":"summary_large_image","twitter_title":"A Step Further \u2014 Demystifying XSS - NSFOCUS","twitter_description":"Here is a comprehensive tutorial on cross-site scripting (XSS) attacks, ranging from entry to practice. Overview Note that XSS attacks are classified","twitter_image":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/XSS-1.jpg","twitter_misc":{"Escrito por":"admin","Est. tempo de leitura":"4 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/nsfocusglobal.com\/a-step-further-demystifying-xss\/#article","isPartOf":{"@id":"https:\/\/nsfocusglobal.com\/a-step-further-demystifying-xss\/"},"author":{"name":"admin","@id":"https:\/\/nsfocusglobal.com\/pt-br\/#\/schema\/person\/fd9ab61c9c77a81bbd870f725cc0c61d"},"headline":"A Step Further \u2014 Demystifying XSS","datePublished":"2017-10-17T15:39:58+00:00","dateModified":"2025-07-09T07:15:58+00:00","mainEntityOfPage":{"@id":"https:\/\/nsfocusglobal.com\/a-step-further-demystifying-xss\/"},"wordCount":887,"commentCount":0,"publisher":{"@id":"https:\/\/nsfocusglobal.com\/pt-br\/#organization"},"image":{"@id":"https:\/\/nsfocusglobal.com\/a-step-further-demystifying-xss\/#primaryimage"},"thumbnailUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/XSS-1.jpg","keywords":["HTML5","Web","XSS"],"articleSection":["Blog","Research &amp; Reports"],"inLanguage":"pt-BR","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/nsfocusglobal.com\/a-step-further-demystifying-xss\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/nsfocusglobal.com\/a-step-further-demystifying-xss\/","url":"https:\/\/nsfocusglobal.com\/a-step-further-demystifying-xss\/","name":"A Step Further \u2014 Demystifying XSS - NSFOCUS","isPartOf":{"@id":"https:\/\/nsfocusglobal.com\/pt-br\/#website"},"primaryImageOfPage":{"@id":"https:\/\/nsfocusglobal.com\/a-step-further-demystifying-xss\/#primaryimage"},"image":{"@id":"https:\/\/nsfocusglobal.com\/a-step-further-demystifying-xss\/#primaryimage"},"thumbnailUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/XSS-1.jpg","datePublished":"2017-10-17T15:39:58+00:00","dateModified":"2025-07-09T07:15:58+00:00","breadcrumb":{"@id":"https:\/\/nsfocusglobal.com\/a-step-further-demystifying-xss\/#breadcrumb"},"inLanguage":"pt-BR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/nsfocusglobal.com\/a-step-further-demystifying-xss\/"]}]},{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/nsfocusglobal.com\/a-step-further-demystifying-xss\/#primaryimage","url":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/XSS-1.jpg","contentUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2017\/10\/XSS-1.jpg","width":500,"height":210,"caption":"XSS acronym for Cross Site Scripting."},{"@type":"BreadcrumbList","@id":"https:\/\/nsfocusglobal.com\/a-step-further-demystifying-xss\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/nsfocusglobal.com\/"},{"@type":"ListItem","position":2,"name":"A Step Further \u2014 Demystifying XSS"}]},{"@type":"WebSite","@id":"https:\/\/nsfocusglobal.com\/pt-br\/#website","url":"https:\/\/nsfocusglobal.com\/pt-br\/","name":"NSFOCUS","description":"Security Made Smart and Simple","publisher":{"@id":"https:\/\/nsfocusglobal.com\/pt-br\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/nsfocusglobal.com\/pt-br\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"pt-BR"},{"@type":"Organization","@id":"https:\/\/nsfocusglobal.com\/pt-br\/#organization","name":"NSFOCUS","url":"https:\/\/nsfocusglobal.com\/pt-br\/","logo":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/nsfocusglobal.com\/pt-br\/#\/schema\/logo\/image\/","url":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/08\/logo-ns.png","contentUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/08\/logo-ns.png","width":248,"height":36,"caption":"NSFOCUS"},"image":{"@id":"https:\/\/nsfocusglobal.com\/pt-br\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/nsfocusglobal.com\/pt-br\/#\/schema\/person\/fd9ab61c9c77a81bbd870f725cc0c61d","name":"admin","image":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/secure.gravatar.com\/avatar\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g","caption":"admin"},"sameAs":["https:\/\/nsfocusglobal.com"],"url":"https:\/\/nsfocusglobal.com\/pt-br\/author\/admin\/"}]}},"_links":{"self":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/posts\/7635","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/comments?post=7635"}],"version-history":[{"count":1,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/posts\/7635\/revisions"}],"predecessor-version":[{"id":32647,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/posts\/7635\/revisions\/32647"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/media\/35814"}],"wp:attachment":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/media?parent=7635"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/categories?post=7635"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/tags?post=7635"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}