cross-site scripting

Cross-Site Scripting (XSS) is an attack where malicious scripts are injected into normal websites.

Prevention

• HTML sanitization: process an HTML document and only preservers desired tags and attributes
• Content Security Policy: block scripts not from trusted domain

Types

Reflected

Reflected XSS occurs when the user input is immediately returned by a web application (as HTML without sanitization). Compare to Stored XSS, it is not as dangerous as the code isn’t stored on the server. ¹

Stored

Stored XSS happens where user input gets stored on the target server, such as in a database, and then get included in pages viewed by other users.

DOM-Based

DOM-Based XSS happens when the attack payload is executed as a result of modifying the DOM “environment” in the victim’s browser, so the client-side code runs in an unexpected manner. ²

This contrasts with the reflected or stored XSS, where the attack payload is part of the HTTP response (due to a server side flaw).

Resources

• Google XSS game

Footnotes

1. Cross Site Scripting (XSS) | OWASP Foundation ↩

2. DOM Based XSS | OWASP Foundation ↩