Cross-Site Scripting (XSS)

Cross-Site Scripting lets an attacker inject malicious scripts into a trusted website, which then execute in the browser of unsuspecting visitors.

How XSS Attacks Work

XSS exploits websites that fail to properly sanitize user input before displaying it back to other users, allowing an attacker's script to run as if it were part of the trusted site.

Types of XSS

Stored XSS saves the malicious script permanently on the server, reflected XSS delivers it through a crafted link, and DOM-based XSS manipulates the page's structure entirely within the browser.

Impact on Users and Sites

A successful XSS attack can steal session cookies, redirect users to malicious sites, or capture keystrokes, all while appearing to come from a legitimate, trusted source.

Preventing XSS

Properly encoding output, validating input, and implementing a strong Content Security Policy are key defenses that stop injected scripts from ever executing.