Course 38 - Web Security Known Web Attacks | Episode 3: RFD, Mutation XSS, and RPO — CyberCode Academy

In this lesson, you’ll learn about: Reflected File Download (RFD), Mutation XSS (mXSS), and Relative Path Overwrite (RPO) XSS1. Reflected File Download (RFD)🔹 Definition:

A vulnerability where user input is reflected into a response that the browser treats as a downloadable file

🔹 How it works (high-level):

Attacker crafts a URL
Server reflects input into response
Browser downloads it as a file (e.g., .bat, .cmd)

👉 Key Insight
The attack relies more on social engineering than pure technical exploitation2. Why RFD is Dangerous🔹 Core risk:

User executes a malicious file thinking it’s legitimate

🔹 Attack characteristics:

File appears trusted (same domain)
Filename can be manipulated
Content may contain system commands

👉 Key Insight
Trust in the source (domain) is what makes this attack effective3. Advanced RFD Scenario🔹 More dangerous variant:

Malicious script modifies browser behavior

🔹 Example impact:

Weakens browser protections
Enables further data access

👉 Key Insight
RFD can act as an entry point for deeper compromise4. Mutation XSS (mXSS)🔹 Definition:

A type of XSS where safe input becomes dangerous after browser processing

🔹 Root cause:

Browser mutates (transforms) HTML internally

👉 Key Insight
The payload is not dangerous initially—it becomes dangerous after parsing5. How mXSS HappensUsing JavaScript:🔹 Scenario:

Application inserts sanitized input into DOM
Browser reinterprets it via innerHTML
Encoded content becomes executable

👉 Key Insight
Security filters can fail due to DOM re-parsing behavior6. Why mXSS Is Tricky🔹 Challenges:

Payload looks harmless
Bypasses traditional filters
Depends on browser quirks

👉 Key Insight
mXSS exploits differences between sanitization and rendering7. Relative Path Overwrite (RPO) XSS🔹 Definition:

Exploits how browsers resolve relative paths

🔹 Core idea:

Trick browser into loading wrong resource (e.g., HTML as CSS)

👉 Key Insight
Path confusion can lead to unexpected code execution contexts8. How RPO Works (Conceptually)🔹 Attack flow:

Modify URL structure (e.g., add /)
Break relative path resolution
Force browser to load unintended resource

👉 Key Insight
Small URL changes can completely alter resource loading behavior9. CSS-Based Execution (Legacy Behavior)🔹 In older browsers:

CSS supported dynamic expressions

🔹 Result:

Injected content could execute scripts through CSS parsing

👉 Key Insight
RPO relies heavily on legacy browser features10. Common Theme Across All Attacks🔹 These vulnerabilities exploit:

Browser parsing logic
Trust assumptions
Inconsistent handling of content

👉 Key Insight
The browser itself becomes part of the attack surface11. Why These Attacks Still Matter🔹 Even if partially outdated:

Legacy systems still exist
Misconfigurations can reintroduce risk
Techniques inspire modern attack methods

👉 Key Insight
Old vulnerabilities often evolve into new exploitation techniques12. Prevention Strategies🔹 General defenses:

Strict input validation and output encoding
Avoid reflecting raw user input
Use absolute paths instead of relative ones
Set correct Content-Type headers
Enforce modern browser security policies

👉 Key Insight
Secure design must consider both server and browser behaviorKey Takeaways

RFD abuses trust to deliver malicious files
mXSS exploits browser DOM mutations
RPO manipulates path resolution and parsing
Many attacks rely on legacy browser behavior
Defense requires understanding how browsers interpret data

Big PictureYou are learning:👉 How client-side attacks go beyond simple XSS
👉 How browsers can unintentionally enable exploits
👉 How security must account for real-world behavior, not just codeMental ModelUser input → browser interpretation → unexpected transformation → exploitation

You can listen and download our episodes for free on more than 10 different platforms:
https://linktr.ee/cybercode_academy