Xss Pillows

n XSS vulnerability arises when web applications take data from users and dynamically include it in web pages without first properly validating the data. XSS vulnerabilities allow an attacker to execute arbitrary commands and display arbitrary content in a victim user's browser. A successful XSS attack leads to an attacker controlling the victim’s browser or account on the vulnerable web application. Although XSS is enabled by vulnerable pages in a web application, the victims of an XSS attack are the application's users, not the application itself. The potency of an XSS vulnerability lies in the fact that the malicious code executes in the context of the victim's session, allowing the attacker to bypass normal security restrictions.

XSS or Cross-site scripting is a security vulnerability affecting some websites. Google OWASP to find out more about this and other security related content if interested :P.

XSS or Cross-site scripting is a security vulnerability affecting some websites. Google OWASP to find out more about this and other security related content if interested :P.

Cool hacker design :) | Perfect for T-shirts, hoodies, mugs, stickers etc!

Here's a cheat sheet like design to remind some of the secure coding measures to prevent all kind XSS attacks: Reflective, Stored or DOM based. Failing to do so, will imply code execution on victim's browser when visiting your site.

The CAPTCHA is annoying for us as humans, but it could be a great way to stop automatic attacks or bots like brute force, CSRF or even XSS attacks.

A cool design with a black background and white letters about one of the web application threats, the cross site scripting or XSS. This kind of attack abuses the weakness of the site to deliver malicious code on clients browsers to steal your cookies or other harmful actions.

An awareness design to tell your peer developers to implement input validation to prevent injection, buffer overflows, denial of service or even log sanitisation.

This design is for bug hunters, who participates in bug bounty programs to discover and research bugs or flaws, that an application may have before a malicious actor find them.

A design about the the common weakness enumeration 78 represented with an icon. This is a good way to concern developers to sanitise any inputs before using them to run any OS command.

A funny design to concern developers that the usage of eval() to process or parse untrusted data could let attackers to inject code to run.

In case that x-powered-by header is delivered by your service, override it with misleading information to make attackers life harder like "Not Your Business 1.0"

This is one of the best practice which is a must when developing any web server that provides cookies. With the secure flag assigned on cookies, it will only be transferred through HTTPS. Black background with white letters design version.

Besides input validation which avoids processing any untrusted data by the application, it is important to perform output validation when writing logs, not only to avoid disclosing any sensitive information but also to prevent local file inclusion attacks.

Want to avoid the undesired clickjacking attack on your website? Then X-Frame-Options should be one of the headers to respond with sameorigin value. Or you can make it even more restrictive with deny. The result is avoiding any eventual attacker to use hidden frames to compromise the website user.

In case that x-powered-by header is delivered by your service, override it with misleading information to make attackers life harder like "Not Your Business 1.0". This is a black background with white letters design.

This is a typical attack that takes advantage from a web server misconfiguration. The result is that the malicious actor can browse the server file system.

The helmet.js should be the minimum security requirement for node.js express applications. By doing so, developers can provide protection to the web application with the necessary secure http headers.

If you passed the OSWE and finally got the certification, then congrats! Reward yourself this design which means that you have tried hard again.

Kind secure coding advice for developers to ensure that the content security policy header is used on http responses and mitigate XSS attacks on users visiting your website. This is a black background with white letters design version.

The helmet.js should be the minimum security requirement for node.js express applications. By doing so, developers can provide protection to the web application with the necessary secure http headers. This is a dark background with white letters design version.

A design made for providing guidance to CSRF attack prevention. If it is not prevented adequately, it may leave attackers to trigger undesired actions from victims' browser like performing inadvertent transactions on your website.

A design about the the common weakness enumeration 79 represented in an iconic way. Good for secure coding guideline and awareness to avoid being vulnerable to XSS attacks.

This design will help you in terms of awareness and training to emphasise the message of not clicking on a wrong or an untrusted link.