Web Security · Junior · Question 26 of 75

An attacker got XSS on your site. What can their script typically do?

1Only read cookies marked HttpOnly
2Only show an alert box, nothing more
✓Correct answer: Anything the user can do on the page: read data, send requests as the user, change the UI

Explanation

The script runs as your site. Even without stealing cookies it can call your APIs with the user's session or show a fake login form.

Further reading

Test yourself

Take the Web Security · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.