Cross-Site Scripting (XSS)
A web vulnerability where attackers inject malicious scripts into trusted websites, which then execute in other users' browsers.
Cross-site scripting (XSS) is a web security vulnerability that enables attackers to inject malicious client-side scripts into web pages viewed by other users. When a web application includes untrusted data in its output without proper validation or encoding, an attacker can embed JavaScript or other executable code that runs in the context of the victim's browser session. Because the malicious code executes from a trusted domain, it has access to cookies, session tokens, and other sensitive data associated with that site.
There are three primary types of XSS. Stored (persistent) XSS occurs when malicious input is permanently saved on the target server — such as in a database, comment field, or forum post — and served to every user who views that content. Reflected XSS happens when malicious input is immediately returned in the server's response, typically through a URL parameter or search query. DOM-based XSS occurs entirely on the client side, where JavaScript code processes untrusted data and inserts it into the page's Document Object Model without sanitization.
XSS attacks can lead to session hijacking, account takeover, defacement of websites, redirection to malicious sites, keystroke logging, and theft of sensitive data. In combination with other techniques, XSS can be used to spread worms across web applications or serve as a vector for more complex attacks. Defense requires a multi-layered approach: output encoding appropriate to the context (HTML, JavaScript, URL, CSS), Content Security Policy (CSP) headers, input validation, and use of modern frameworks that automatically escape output.
There are three primary types of XSS. Stored (persistent) XSS occurs when malicious input is permanently saved on the target server — such as in a database, comment field, or forum post — and served to every user who views that content. Reflected XSS happens when malicious input is immediately returned in the server's response, typically through a URL parameter or search query. DOM-based XSS occurs entirely on the client side, where JavaScript code processes untrusted data and inserts it into the page's Document Object Model without sanitization.
XSS attacks can lead to session hijacking, account takeover, defacement of websites, redirection to malicious sites, keystroke logging, and theft of sensitive data. In combination with other techniques, XSS can be used to spread worms across web applications or serve as a vector for more complex attacks. Defense requires a multi-layered approach: output encoding appropriate to the context (HTML, JavaScript, URL, CSS), Content Security Policy (CSP) headers, input validation, and use of modern frameworks that automatically escape output.
Examples
- An attacker posts a comment containing a script tag on a forum; when other users view the comment, the script steals their session cookies.
- A search results page reflects user input without encoding, allowing an attacker to craft a URL that executes JavaScript when clicked.
- Malicious JavaScript injected into a user profile field redirects visitors to a phishing site.
Prevention
- Encode all user-supplied data before rendering it in HTML, JavaScript, URLs, or CSS contexts.
- Implement a strict Content Security Policy (CSP) header to restrict script execution sources.
- Use modern web frameworks that provide automatic output escaping by default.
- Validate and sanitize all user input on the server side, rejecting unexpected characters or patterns.