LocalStorage Exploit Via Cross Site Scripting

Cross Site Scripting (XSS)

XSS is ranked as number 3 in the OWASP 2013 Top 10. 

XSS is the injection of malicious scripts into a webpage causing it to react in a way not intended by the developer. It is possible to carry out an XSS attack against a site that uses input from a user in the output it generates without validating or encoding it. By injecting a simple script like <script>alert(1)</script> into the search box on the altoro site, the application responds with:- 

CSP - Content Security Policy

Whilst researching Security in HTML5 I stumbled across this great article on Content Security Policy written by a guy called Mike West which I will try and summarise! There was a lot of great stuff in there so this is probably no shorter than his article!

CSP stands for Content Security Policy. The aim of the policy is to mitigate injection attacks faced by website. It is currently a ‘Working Draft’ from w3c.