Cross-Site Scripting (XSS)
What Is Cross-Site Scripting?
Cross-Site Scripting (XSS) is an attack where malicious scripts are injected into a trusted website, which then executes in the browser of anyone who visits the compromised page.
Types of XSS Attacks
| Type | How It Works |
|---|---|
| Stored XSS | Malicious script is permanently saved on the target server |
| Reflected XSS | Malicious script is reflected off a server via a crafted link |
| DOM-based XSS | The vulnerability exists in client-side JavaScript itself |
What XSS Enables Attackers to Do
A successful XSS attack can let an attacker steal session cookies, redirect users to malicious sites, or perform actions on behalf of the victim without their knowledge.
Preventing XSS
Proper output encoding, input validation, and Content Security Policy (CSP) headers together form the core defense against XSS, ensuring user-supplied input is never treated as executable code by the browser.
SQL Injection and XSS both exploit application weaknesses - a very different, more direct approach is the brute force attack.
Ready to master Cybersecurity Training Course?
Join Uncodemy's hands-on training and build real-world cybersecurity skills with expert mentors.