Cross-site scripting

lastmod 2023-02-08created 2015-03-184 edits

Cross-site scripting (abbreviated XSS) is one of the vulnerabilities commonly found in web applications: it allows someone other than the website administrator to insert malicious scripts into a web page. It is typically carried out by posting content containing a malicious script to an online bulletin board viewed by many users. The vulnerability occurs when a web application uses values received from users without properly validating them. Through this vulnerability, a hacker can steal user information (cookies, sessions, etc.) or make the application automatically perform abnormal functions. It is called cross-site scripting because it mainly works by exchanging information with other websites.

Categories

HTTP Headers

• Strict-Transport-Security
• X-Frame-Options
• X-XSS-Protection
• X-Content-Type-Options
• Content-Security-Policy

Reflected XSS

Stored XSS

DOM Based XSS

Documentation

Types of cross-site scripting (XSS) attacks and countermeasures

See also

• Hacking
• Security vulnerability
• Information Security
• Internet security
• Web Hacking

Favorite site

• Wikipedia (en) XSS
• What is an XSS (Cross Site Scripting) attack? :: ARGOS