Cross-Site Scripting

Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. There are three main types of XSS: Reflected, Stored, and DOM-based.

Reflected XSS occurs when an attacker injects malicious scripts into a web application's response to a user's request. For example, an attacker could construct a URL like https://insecure-website/search?term=script/* insert bad stuff here *//script to trick the website into displaying the injected script.

Stored XSS, also known as Second-order or persistent XSS, happens when a web application stores malicious scripts submitted by users and later displays them to other users. For instance, if a website allows users to submit comments on blog posts and stores these comments in its database, an attacker could submit a comment containing a malicious script. When another user views the comment, the script will be executed.

DOM-based XSS arises when JavaScript code takes data from an attacker-controllable source, such as the URL, and passes it to a sink that supports dynamic code execution. This allows attackers to execute arbitrary JavaScript code, potentially hijacking other users' accounts.

To exploit DOM-based XSS, attackers need to place data into a source so that it gets propagated to a sink, causing the execution of malicious JavaScript. Common sources for DOM XSS include the URL, which can be accessed using the window.location object. Attackers can construct a link with a payload in the query string or fragment portions of the URL to deliver the payload to a vulnerable page.

Two other forms of XSS are DOM Sinks and Sources, Testing XSS, and Content Security Policy (CSP). DOM sinks and sources refer to the places within a web page where JavaScript code can be executed. Testing XSS involves identifying the XSS context, which is the location within the response where attacker-controllable data appears. CSP is a browser mechanism that aims to mitigate the impact of XSS and other vulnerabilities. However, it can sometimes be bypassed, enabling the exploitation of the underlying vulnerability.