SPRG Logs

XSS injects attacker JavaScript into a trusted page; it's a "confused deputy" because the victim's browser runs that script with the victim's own privileges, trusting it because it came from the legitimate site. Cross-Site Scripting (XSS): Exploits a flaw in a web application to...

Quiz: SPRG / Input Validation & Output Encoding | updated: Jul 31, 2026

CSRF tokens (a secret the attacker can't read), the SameSite cookie attribute (browser won't send the cookie cross-site), and double-submit cookies (token in both cookie and request, must match). * Each defence removes a different prerequisite of the attack — a secret to supply,...

Quiz: SPRG / Input Validation & Output Encoding | updated: Jul 31, 2026

By converting dangerous characters into harmless display equivalents (< → &lt;) at render time, so attacker input shows as text instead of executing as markup. Good frameworks do this by default, and you must not turn it off for untrusted data. The key insight: input validation a...

Quiz: SPRG / Input Validation & Output Encoding | updated: Jul 31, 2026

Because the blast radius is the whole table, not one account: the database has no concept of "only this user's rows", so one broken query can hand over every record. The 2012–2017 breach roll-call runs from a single admin account to 145 million people. * The same flaw class, fou...

Quiz: SPRG / Input Validation & Output Encoding | updated: Jul 31, 2026

Because XSS payloads exploit dozens of obscure parsing quirks (case tricks, Unicode escapes, comment breakouts) that hand-rolled filters miss — framework escaping is battle-tested against all of them. A hand-rolled filter can only block the tricks its author thought of. The troub...

Quiz: SPRG / Input Validation & Output Encoding | updated: Jul 31, 2026

The same data needs different encoding depending on where it lands (HTML body vs attribute vs JavaScript vs URL vs CSS) — encode for the wrong context and the output is still exploitable. * Contextual output encoding — the same data needs a different escape depending on where it...

Quiz: SPRG / Input Validation & Output Encoding | updated: Jul 31, 2026

Embed a hidden, unpredictable CSRF token in the form and validate it server-side — a forged cross-site request can't supply the right one. HTML form with CSRF token: <form action="/transfer" method="POST"> <input type="hidden" name="csrf_token" value="a8f3b2c1d4e5..."> <input...

Quiz: SPRG / Input Validation & Output Encoding | updated: Jul 31, 2026

Because the input lands in the middle of someone else's statement. The payload has to close the quote it was dropped into, match the original SELECT's column count and types, and comment away the leftovers — only then does the combined string still parse. * Anatomy of the payloa...

Quiz: SPRG / Input Validation & Output Encoding | updated: Jul 31, 2026

The top split is how the payload reaches its target — 1st order, 2nd order, or lateral. 1st order then splits again by how the results come back: in-band, blind (inferential), or out-of-band. * Injection taxonomy — 1st order / 2nd order / lateral at the top; only 1st order split...

Quiz: SPRG / Input Validation & Output Encoding | updated: Jul 31, 2026

Same idea as SQL injection, but the interpreter is an XPath engine querying an XML document — break out of the query string to return data you shouldn't see. Prevent it by XML-encoding input before building the query. XPath is the query language for XML: you give it a path throug...

Quiz: SPRG / Input Validation & Output Encoding | updated: Jul 31, 2026