Test yourself under real exam conditions: 50 timed questions, 60 on the clock, pass mark 70%%. Instant score with a full review of everything you got wrong. Free — no account needed.
Exam details
The OWASP Top 10 is a regularly updated list of the most critical web application security risks. The 2021 edition includes:
XSS is a vulnerability where an attacker injects malicious scripts into web pages viewed by other users. Three types:
Reflected XSS occurs when user input from a request is immediately included in the response without proper encoding. Example: a search page that displays the query parameter without sanitization. Prevention:
Content-Security-Policy headersStored XSS (persistent XSS) occurs when malicious script is saved on the server (e.g., in a database, forum post, or comment) and served to users who view that content. It's more dangerous than reflected XSS because it affects all users who view the page, not just those who click a crafted link. Prevention: sanitize on input, encode on output.
DOM-based XSS occurs entirely on the client side — the vulnerability exists in JavaScript code that processes data from an untrusted source (like location.hash) and writes it to the DOM using unsafe methods like innerHTML or document.write(). The malicious payload never reaches the server. Prevention: use textContent instead of innerHTML, avoid eval().