Different types of XSS and SQLi and difference between them.

Question

Accepted Answer

XSS and SQLi are common web application vulnerabilities. XSS allows attackers to inject malicious scripts, while SQLi allows them to manipulate database queries.

XSS (Cross-Site Scripting) is a vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
There are three types of XSS: Stored XSS, Reflected XSS, and DOM-based XSS.
Stored XSS occurs when the malicious script is permanently stored on the target server and served to users.
Reflected XSS occurs when the malicious script is embedded in a URL and executed when the user clicks on the manipulated link.
DOM-based XSS occurs when the client-side script manipulates the Document Object Model (DOM) of a web page.
SQLi (SQL Injection) is a vulnerability that allows attackers to manipulate database queries through user input.
There are two types of SQLi: In-band SQLi and Blind SQLi.
In-band SQLi is the most common type, where the attacker can directly retrieve data from the database or modify it.
Blind SQLi is more complex, where the attacker can infer information from the application's response without directly retrieving data.
Example of XSS:
Example of SQLi: SELECT * FROM users WHERE username = 'admin' AND password = ' OR '1'='1';

Accepted Answer

XSS (cross site scripting) : it is kind of security exploit.

The attackers injects some kind javascript payloads. In order to get some sensitive data.

Main purpose of XSS is

1.stealing the session id's

to know the IP address
Replacing of current website to other website

SQLi :

It is also kind of security exploit.

In SQLi the attacker injects som kind of sql payloads/or some sql crafted quaries for the purpose of

1.Authntication bypass

2.database compromise.

Asked in eClinicalWorks

Different types of XSS and SQLi and difference between them.

Interview Questions Asked to Security Analyst at Other Companies

Top Skill-Based Questions for eClinicalWorks Security Analyst