XSS

Definitions

1. XSS, or Cross-Site Scripting, is a web security vulnerability that allows an attacker to inject malicious JavaScript code into web pages viewed by other users. When a web application includes user-supplied data in its output without proper sanitization or encoding, attackers can insert scripts that execute in victims' browsers with full access to the page's DOM, cookies, and session data. Stored XSS persists the malicious script in the application's database (for example, in a forum post), affecting every user who views the content. Reflected XSS embeds the payload in a URL that the victim must click. DOM-based XSS manipulates the client-side JavaScript environment without involving the server. XSS can steal session tokens, redirect users to malicious sites, deface web pages, and capture keystrokes. Defenses include output encoding, Content Security Policy (CSP) headers, input validation, and HttpOnly cookie flags that prevent JavaScript from accessing session cookies.

   In plain English: A trick where a hacker slips harmful code into a website so that when you visit it, the code runs in your browser and can steal your information.

Etymology

2000

Microsoft engineers coin 'cross-site scripting' (XSS) to describe attacks that inject JavaScript into web pages viewed by other users

2005

The Samy worm spreads via XSS on MySpace, adding over a million friends to the attacker's profile in 20 hours

2010s

Content Security Policy (CSP) headers emerge as a browser-level defense against XSS

Related Terms

• SQL Injection
• CSRF
• OWASP
• SSRF
• Cold Storage
• Content Filtering
• Cookie Security
• Dead Drop
• Detection Signature
• Feature Abuse
• Initial Access
• Malvertising
• Poison Pill
• Reflected Input
• Request Forgery
• Request Validation
• Reverse Proxy Security
• Rich Text Attack