Cross-Site Scripting

web security

Definition

Cross-Site Scripting (XSS)

Cross-Site Scripting is a client-side injection in which an attacker places JavaScript into a benign page that runs in the victim’s browser. Because the script executes on the target origin (e.g. bank.com), it gains full read/write control over that origin’s DOM and cookie jar — a Same-Origin Policy bypass executed by a script that the application itself served.

The root cause is the server-side one recycled client-side: mixing code and data — here, concatenating user input into HTML that the browser then parses as instructions.

Dimensions

Reflected vs stored, server-side vs client-side

	Server-side	Client-side
Reflected	payload is echoed from the request into the server’s response; victim must click a forged link	payload sits in the URL (often the fragment) and is read by client-side JS; never sent to the server, so it may not appear in server logs
Stored	payload is persisted on the server (e.g. a comment) and served to every visitor	payload is persisted in client storage (localStorage, a cookie) and read back at each visit

See Reflected XSS and Stored XSS for the worked forms.