https://elvis.hcw.ac.at/wiki/api.php?action=feedcontributions&feedformat=atom&user=DLechner 2026-09-10T18:06:28Z User contributions MediaWiki 1.41.5 https://elvis.hcw.ac.at/wiki/index.php?title=Cross-Site_Request_Forgery_(CSRF)&diff=5669 2020-12-28T17:01:06Z

<p>DLechner: </p> <hr /> <div>[[Category:Basic]]<br /> <br /> = Cross-Site-Request Forgery =<br /> Victims are executing actions unwillingly on Webapplications they are authenticated to. Some of those actions are<br /> * changing password<br /> * changing email-addresse<br /> * changing user-role<br /> * create account<br /> * transfer money<br /> <br /> = Prevention =<br /> === Synchronizer Token Pattern (STP) ===<br /> This pattern includes a token, secret and a unique value in each request which is then validated by the server.<br /> === Cookie ===<br /> Set the &quot;SameSite&quot; attribute to &quot;Strict&quot; to stripe it off all cross-origin requests.<br /> === Custom HTTP-Header ===<br /> Custom-Header can only be added by JavaScript and only within its origin.</div>

DLechner https://elvis.hcw.ac.at/wiki/index.php?title=Cross-Site_Request_Forgery_(CSRF)&diff=5668 2020-12-28T17:00:53Z

<p>DLechner: </p> <hr /> <div>[[Category:Basic]]<br /> <br /> = Cross-Site-Request Forgery =<br /> Victims are executing actions unwillingly on Webapplications they are authenticated to. Some of those actions are<br /> * changing password<br /> * changing email-addresse<br /> * changing user-role<br /> * create account<br /> * transfer money<br /> <br /> = Prevention =<br /> === Synchronizer Token Pattern (STP) ===+<br /> This pattern includes a token, secret and a unique value in each request which is then validated by the server.<br /> === Cookie ===<br /> Set the &quot;SameSite&quot; attribute to &quot;Strict&quot; to stripe it off all cross-origin requests.<br /> === Custom HTTP-Header ===<br /> Custom-Header can only be added by JavaScript and only within its origin.</div>

DLechner https://elvis.hcw.ac.at/wiki/index.php?title=Cross-Site_Scripting_(XSS)&diff=5667 2020-12-28T16:51:08Z

<p>DLechner: /* Protection */</p> <hr /> <div>[[Category:Basic]]<br /> == Cross-Site-Scripting (XSS) ==<br /> <br /> Attackers use Webapplications injecting client-side code to gain data from users, like cookies or private information. It's also possible to trigger actions on websites, redirect to other sites or hide advertisements. A short game with which some options can be seen easily: [https://xss-game.appspot.com/ XSS game]<br /> <br /> == Types ==<br /> There are two ways to classify XSS attacks. Up until 2012 the types DOM-based (Type 0), stored/persistent (Type I) and reflected/non-persistent (Type II) were used. As these three types can overlap the research community started to use the terms Server XSS and Client XSS from 2012 on.<br /> [[File:Server-XSS_vs_Client-XSS_Chart.png|200px|thumb]]<br /> <br /> === Persistent (Type I) ===<br /> This can occur if user input is permanently stored on a server or in the web browser. The victims get the data then directly from there.<br /> <br /> === Reflected (Type II) ===<br /> Malicious code is directly injected using the request. Hereby the data sent by an http-Request is directly used to perfom actions.<br /> <br /> === DOM Based (Type 0) ===<br /> DOM Based attacks were added in 2005 and are attacks that take place entirely within the web browser.<br /> <br /> == Prevention==<br /> *Never trust user input<br /> *Recursive sanitization<br /> *Encoding</div>

DLechner https://elvis.hcw.ac.at/wiki/index.php?title=Cross-Site_Request_Forgery_(CSRF)&diff=5666 2020-12-28T16:48:27Z

<p>DLechner: Removed redirect to Basic:Cross-Site-Request-Forgery</p> <hr /> <div>[[Category:Basic]]<br /> <br /> Victims are executing actions unwillingly on Webapplications they are authenticated to. Some of those actions are<br /> * changing password<br /> * changing email-addresse<br /> * changing user-role<br /> * create account<br /> * transfer money</div>

DLechner https://elvis.hcw.ac.at/wiki/index.php?title=Cross-Site_Scripting_(XSS)&diff=5665 2020-12-28T16:44:53Z

<p>DLechner: </p> <hr /> <div>[[Category:Basic]]<br /> == Cross-Site-Scripting (XSS) ==<br /> <br /> Attackers use Webapplications injecting client-side code to gain data from users, like cookies or private information. It's also possible to trigger actions on websites, redirect to other sites or hide advertisements. A short game with which some options can be seen easily: [https://xss-game.appspot.com/ XSS game]<br /> <br /> == Types ==<br /> There are two ways to classify XSS attacks. Up until 2012 the types DOM-based (Type 0), stored/persistent (Type I) and reflected/non-persistent (Type II) were used. As these three types can overlap the research community started to use the terms Server XSS and Client XSS from 2012 on.<br /> [[File:Server-XSS_vs_Client-XSS_Chart.png|200px|thumb]]<br /> <br /> === Persistent (Type I) ===<br /> This can occur if user input is permanently stored on a server or in the web browser. The victims get the data then directly from there.<br /> <br /> === Reflected (Type II) ===<br /> Malicious code is directly injected using the request. Hereby the data sent by an http-Request is directly used to perfom actions.<br /> <br /> === DOM Based (Type 0) ===<br /> DOM Based attacks were added in 2005 and are attacks that take place entirely within the web browser.<br /> <br /> == Protection ==<br /> *Never trust user input<br /> *Recursive sanitization<br /> *Encoding</div>

DLechner https://elvis.hcw.ac.at/wiki/index.php?title=Cross-Site_Request_Forgery_(CSRF)&diff=5664 2020-12-28T16:42:04Z

<p>DLechner: Redirected page to Basic:Cross-Site-Request-Forgery</p> <hr /> <div>#redirect[[Basic:Cross-Site-Request-Forgery]]</div>

DLechner https://elvis.hcw.ac.at/wiki/index.php?title=Cross-Site_Scripting_(XSS)&diff=5663 2020-12-28T16:32:27Z

<p>DLechner: /* Protection */</p> <hr /> <div>== Cross-Site-Scripting (XSS) ==<br /> <br /> Attackers use Webapplications injecting client-side code to gain data from users, like cookies or private information. It's also possible to trigger actions on websites, redirect to other sites or hide advertisements. A short game with which some options can be seen easily: [https://xss-game.appspot.com/ XSS game]<br /> <br /> == Types ==<br /> There are two ways to classify XSS attacks. Up until 2012 the types DOM-based (Type 0), stored/persistent (Type I) and reflected/non-persistent (Type II) were used. As these three types can overlap the research community started to use the terms Server XSS and Client XSS from 2012 on.<br /> [[File:Server-XSS_vs_Client-XSS_Chart.png|200px|thumb]]<br /> <br /> === Persistent (Type I) ===<br /> This can occur if user input is permanently stored on a server or in the web browser. The victims get the data then directly from there.<br /> <br /> === Reflected (Type II) ===<br /> Malicious code is directly injected using the request. Hereby the data sent by an http-Request is directly used to perfom actions.<br /> <br /> === DOM Based (Type 0) ===<br /> DOM Based attacks were added in 2005 and are attacks that take place entirely within the web browser.<br /> <br /> == Protection ==<br /> *Never trust user input<br /> *Recursive sanitization<br /> *Encoding</div>

DLechner https://elvis.hcw.ac.at/wiki/index.php?title=Cross-Site_Scripting_(XSS)&diff=5662 2020-12-28T16:26:12Z

<p>DLechner: /* Types */</p> <hr /> <div>== Cross-Site-Scripting (XSS) ==<br /> <br /> Attackers use Webapplications injecting client-side code to gain data from users, like cookies or private information. It's also possible to trigger actions on websites, redirect to other sites or hide advertisements. A short game with which some options can be seen easily: [https://xss-game.appspot.com/ XSS game]<br /> <br /> == Types ==<br /> There are two ways to classify XSS attacks. Up until 2012 the types DOM-based (Type 0), stored/persistent (Type I) and reflected/non-persistent (Type II) were used. As these three types can overlap the research community started to use the terms Server XSS and Client XSS from 2012 on.<br /> [[File:Server-XSS_vs_Client-XSS_Chart.png|200px|thumb]]<br /> <br /> === Persistent (Type I) ===<br /> This can occur if user input is permanently stored on a server or in the web browser. The victims get the data then directly from there.<br /> <br /> === Reflected (Type II) ===<br /> Malicious code is directly injected using the request. Hereby the data sent by an http-Request is directly used to perfom actions.<br /> <br /> === DOM Based (Type 0) ===<br /> DOM Based attacks were added in 2005 and are attacks that take place entirely within the web browser.<br /> <br /> == Protection ==<br /> *Never trust user input<br /> *Recursive sanatization<br /> *Encoding</div>

DLechner https://elvis.hcw.ac.at/wiki/index.php?title=Cross-Site_Scripting_(XSS)&diff=5661 2020-12-28T16:26:01Z

<p>DLechner: /* Protection */</p> <hr /> <div>== Cross-Site-Scripting (XSS) ==<br /> <br /> Attackers use Webapplications injecting client-side code to gain data from users, like cookies or private information. It's also possible to trigger actions on websites, redirect to other sites or hide advertisements. A short game with which some options can be seen easily: [https://xss-game.appspot.com/ XSS game]<br /> <br /> == Types ==<br /> There are two ways to classify XSS attacks. Up until 2012 the types DOM-based (Type 0), stored/persistent (Type I) and reflected/non-persistent (Type II) were used. As these three types can overlap the research community started to use the terms Server XSS and Client XSS from 2012 on.<br /> [[File:Server-XSS_vs_Client-XSS_Chart.png|300px|thumb]]<br /> <br /> === Persistent (Type I) ===<br /> This can occur if user input is permanently stored on a server or in the web browser. The victims get the data then directly from there.<br /> <br /> === Reflected (Type II) ===<br /> Malicious code is directly injected using the request. Hereby the data sent by an http-Request is directly used to perfom actions.<br /> <br /> === DOM Based (Type 0) ===<br /> DOM Based attacks were added in 2005 and are attacks that take place entirely within the web browser.<br /> <br /> == Protection ==<br /> *Never trust user input<br /> *Recursive sanatization<br /> *Encoding</div>

DLechner https://elvis.hcw.ac.at/wiki/index.php?title=Cross-Site_Scripting_(XSS)&diff=5660 2020-12-28T16:25:14Z

<p>DLechner: </p> <hr /> <div>== Cross-Site-Scripting (XSS) ==<br /> <br /> Attackers use Webapplications injecting client-side code to gain data from users, like cookies or private information. It's also possible to trigger actions on websites, redirect to other sites or hide advertisements. A short game with which some options can be seen easily: [https://xss-game.appspot.com/ XSS game]<br /> <br /> == Types ==<br /> There are two ways to classify XSS attacks. Up until 2012 the types DOM-based (Type 0), stored/persistent (Type I) and reflected/non-persistent (Type II) were used. As these three types can overlap the research community started to use the terms Server XSS and Client XSS from 2012 on.<br /> [[File:Server-XSS_vs_Client-XSS_Chart.png|300px|thumb]]<br /> <br /> === Persistent (Type I) ===<br /> This can occur if user input is permanently stored on a server or in the web browser. The victims get the data then directly from there.<br /> <br /> === Reflected (Type II) ===<br /> Malicious code is directly injected using the request. Hereby the data sent by an http-Request is directly used to perfom actions.<br /> <br /> === DOM Based (Type 0) ===<br /> DOM Based attacks were added in 2005 and are attacks that take place entirely within the web browser.<br /> <br /> == Protection ==<br /> Never trust user input<br /> Recursive sanatization<br /> Encoding</div>

DLechner https://elvis.hcw.ac.at/wiki/index.php?title=Cross-Site_Scripting_(XSS)&diff=5659 2020-12-28T16:22:22Z

<p>DLechner: </p> <hr /> <div>== Cross-Site-Scripting (XSS) ==<br /> <br /> Attackers use Webapplications injecting client-side code to gain data from users, like cookies or private information. It's also possible to trigger actions on websites, redirect to other sites or hide advertisements. A short game with which some options can be seen easily: [https://xss-game.appspot.com/ XSS game]<br /> <br /> == Types ==<br /> There are two ways to classify XSS attacks. Up until 2012 the types DOM-based (Type 0), stored/persistent (Type I) and reflected/non-persistent (Type II) were used. As these three types can overlap the research community started to use the terms Server XSS and Client XSS from 2012 on.<br /> [[File:Server-XSS_vs_Client-XSS_Chart.png|300px|thumb]]<br /> <br /> ==== Persistent (Type I) ====<br /> This can occur if user input is permanently stored on a server or in the web browser. The victims get the data then directly from there.<br /> <br /> ==== Reflected (Type II) ====<br /> Malicious code is directly injected using the request. Hereby the data sent by an http-Request is directly used to perfom actions.<br /> <br /> ==== DOM Based (Type 0) ====<br /> DOM Based attacks were added in 2005 and are attacks that take place entirely within the web browser.</div>

DLechner https://elvis.hcw.ac.at/wiki/index.php?title=File:Server-XSS_vs_Client-XSS_Chart.png&diff=5658 2020-12-28T16:21:22Z

<p>DLechner: </p> <hr /> <div></div>

DLechner https://elvis.hcw.ac.at/wiki/index.php?title=Category:Cross-Site-Scripting_(XSS)&diff=5657 2020-12-28T16:11:13Z

<p>DLechner: DLechner moved page Category:Cross-Site-Scripting (XSS) to Cross-Site-Scripting (XSS)</p> <hr /> <div>#REDIRECT [[Cross-Site-Scripting (XSS)]]</div>

DLechner https://elvis.hcw.ac.at/wiki/index.php?title=Cross-Site_Scripting_(XSS)&diff=5656 2020-12-28T16:11:13Z

<p>DLechner: DLechner moved page Category:Cross-Site-Scripting (XSS) to Cross-Site-Scripting (XSS)</p> <hr /> <div>== Cross-Site-Scripting (XSS) ==<br /> <br /> Attackers use Webapplications injecting client-side code to gain data from users, like cookies or private information. It's also possible to trigger actions on websites, redirect to other sites or hide advertisements. A short game with which some options can be seen easily: [https://xss-game.appspot.com/ XSS game]<br /> <br /> == Types ==<br /> There are two ways to classify XSS attacks. Up until 2012 the types DOM-based (Type 0), stored/persistent (Type I) and reflected/non-persistent (Type II) were used. As these three types can overlap the research community started to use the terms Server XSS and Client XSS from 2012 on.<br /> <br /> ==== Persistent (Type I) ====<br /> This can occur if user input is permanently stored on a server or in the web browser. The victims get the data then directly from there.<br /> <br /> ==== Reflected (Type II) ====<br /> Malicious code is directly injected using the request. Hereby the data sent by an http-Request is directly used to perfom actions.<br /> <br /> ==== DOM Based (Type 0) ====<br /> DOM Based attacks were added in 2005 and are attacks that take place entirely within the web browser.</div>

DLechner https://elvis.hcw.ac.at/wiki/index.php?title=Category_talk:Basic&diff=5655 2020-12-28T16:09:46Z

<p>DLechner: DLechner moved page Category talk:Basic to Category:Cross-Site-Scripting (XSS)</p> <hr /> <div>#REDIRECT [[:Category:Cross-Site-Scripting (XSS)]]</div>

DLechner https://elvis.hcw.ac.at/wiki/index.php?title=Cross-Site_Scripting_(XSS)&diff=5654 2020-12-28T16:09:46Z

<p>DLechner: DLechner moved page Category talk:Basic to Category:Cross-Site-Scripting (XSS)</p> <hr /> <div>== Cross-Site-Scripting (XSS) ==<br /> <br /> Attackers use Webapplications injecting client-side code to gain data from users, like cookies or private information. It's also possible to trigger actions on websites, redirect to other sites or hide advertisements. A short game with which some options can be seen easily: [https://xss-game.appspot.com/ XSS game]<br /> <br /> == Types ==<br /> There are two ways to classify XSS attacks. Up until 2012 the types DOM-based (Type 0), stored/persistent (Type I) and reflected/non-persistent (Type II) were used. As these three types can overlap the research community started to use the terms Server XSS and Client XSS from 2012 on.<br /> <br /> ==== Persistent (Type I) ====<br /> This can occur if user input is permanently stored on a server or in the web browser. The victims get the data then directly from there.<br /> <br /> ==== Reflected (Type II) ====<br /> Malicious code is directly injected using the request. Hereby the data sent by an http-Request is directly used to perfom actions.<br /> <br /> ==== DOM Based (Type 0) ====<br /> DOM Based attacks were added in 2005 and are attacks that take place entirely within the web browser.</div>

DLechner https://elvis.hcw.ac.at/wiki/index.php?title=Cross-Site_Scripting_(XSS)&diff=5653 2020-12-28T16:06:41Z

<p>DLechner: /* Cross-Site-Scripting (XSS) */ new section</p> <hr /> <div>== Cross-Site-Scripting (XSS) ==<br /> <br /> Attackers use Webapplications injecting client-side code to gain data from users, like cookies or private information. It's also possible to trigger actions on websites, redirect to other sites or hide advertisements. A short game with which some options can be seen easily: [https://xss-game.appspot.com/ XSS game]<br /> <br /> == Types ==<br /> There are two ways to classify XSS attacks. Up until 2012 the types DOM-based (Type 0), stored/persistent (Type I) and reflected/non-persistent (Type II) were used. As these three types can overlap the research community started to use the terms Server XSS and Client XSS from 2012 on.<br /> <br /> ==== Persistent (Type I) ====<br /> This can occur if user input is permanently stored on a server or in the web browser. The victims get the data then directly from there.<br /> <br /> ==== Reflected (Type II) ====<br /> Malicious code is directly injected using the request. Hereby the data sent by an http-Request is directly used to perfom actions.<br /> <br /> ==== DOM Based (Type 0) ====<br /> DOM Based attacks were added in 2005 and are attacks that take place entirely within the web browser.</div>

DLechner