What is XSS?

Cross-Site Scripting (XSS) is a web application vulnerability where attackers inject malicious scripts into web pages viewed by other users, enabling session hijacking and data theft.

What is XSS?

Cross-Site Scripting (XSS) is a web application vulnerability that allows attackers to inject malicious client-side scripts into web pages served to other users. When victims view the compromised page, the injected script executes in their browser context with access to cookies, session tokens, and page content. XSS enables session hijacking, credential theft, defacement, malware distribution, and social engineering attacks against authenticated users.

What are the types of XSS?

XSS types include Reflected XSS where malicious scripts are embedded in URLs and reflected off the server in responses, Stored XSS where scripts persist in application databases and execute for all users viewing affected content, and DOM-based XSS where client-side JavaScript processes untrusted data into executable code without server involvement. Stored XSS is most dangerous due to its persistent nature affecting all visitors to compromised pages.

How do XSS attacks work?

XSS attacks inject JavaScript code through application inputs that are rendered in HTML responses without proper encoding. For reflected XSS, attackers craft URLs containing script payloads distributed through phishing. For stored XSS, attackers submit scripts through forms that persist in the database. When other users load pages containing the unencoded input, their browsers execute the attacker's script with full access to the page's DOM, cookies, and authenticated session.

How do you prevent XSS vulnerabilities?

Prevent XSS through output encoding that converts special characters to HTML entities before rendering user data, Content Security Policy headers restricting script execution sources, input validation rejecting unexpected data formats, using framework auto-encoding features like React JSX and Angular template binding, implementing HttpOnly cookie flags preventing JavaScript cookie access, and applying context-specific encoding for HTML, JavaScript, URL, and CSS contexts.

What is Content Security Policy and how does it prevent XSS?

Content Security Policy (CSP) is an HTTP header that restricts which sources browsers can load scripts, styles, and other resources from. By specifying allowed script sources and disabling inline script execution, CSP prevents injected scripts from running even when XSS vulnerabilities exist in application code. A strict CSP using nonce-based or hash-based script authorization provides robust defense-in-depth against XSS exploitation.

What damage can XSS attacks cause?

XSS attacks enable session token theft leading to account takeover, credential harvesting through injected fake login forms, defacement modifying page content visible to victims, malware distribution through drive-by download injection, keylogging capturing all user input on affected pages, webcam and microphone access through browser API exploitation, cryptocurrency mining using victim browser resources, and worm-like self-propagation through stored XSS in social platforms.

How do penetration testers find XSS vulnerabilities?

Penetration testers find XSS by systematically injecting test payloads into all user-controllable inputs including URL parameters, form fields, HTTP headers, and cookie values. They test for output encoding failures across different rendering contexts (HTML, JavaScript, attributes, URLs), evaluate Content Security Policy effectiveness, test DOM-based sinks and sources in client-side code, and verify that framework-level protections are consistently applied across all application endpoints.

What is the difference between XSS and CSRF?

XSS injects malicious scripts that execute in the victim's browser, accessing the page DOM, cookies, and session. CSRF tricks the victim's browser into making unwanted authenticated requests to a target application without script injection. XSS exploits user trust in a website by running arbitrary code, while CSRF exploits website trust in the user's browser by forging authenticated requests. Different prevention mechanisms address each vulnerability type independently.