Cross-Site Scripting (XSS)
In this chapter, we are going to learn about Cross-Site Scripting (XSS).
Last updated
Was this helpful?
In this chapter, we are going to learn about Cross-Site Scripting (XSS).
Last updated
Was this helpful?
Client-side
Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. (src: )
Before we are diving deeper into the variations of XSS, let’s have a quick look at an example, how an XSS exploit looks like: (SAMPLE VIDEO)
Reflected XSS occurs if user input is sent to the server within an HTTP request, which is then immediately printed out on the website in an insecure fashion.
A classic example would be a URL, which contains a parameter that can be altered by a user, where the input is mirrored and made visible.
If the underlying code responsible for creating the server response is not performing any type of sanitisation and if the output is not properly encoded, an attacker could try to send a malicious request.
If an attacker would craft such a malicious example and send it to his victim, the victim would see an alert box popping up displaying the website’s domain. The attacker would need an additional trick to make the victim click on the URL (such as a phishing email).
(by )
(by )
(by )
(by )