Cross-Site Scripting (XSS)

How Attackers Use It

Attack Summary

Malicious JavaScript is injected into a page and executed in other users' browsers. Used for session token theft, keylogging, defacement, and drive-by download distribution.

• Attacker identifies an input or rendering sink that reflects unsanitized content.
• Payload execution is validated in target browsers and rendering contexts.
• Session theft, credential capture, and malicious redirects are chained.
• Persistent vectors can hit all users viewing compromised content.

Defensive Strategy

Defense Summary

Context-aware output encoding. Content Security Policy (CSP) headers. HttpOnly cookies. DOM-based XSS sinks audited at code review.

• Apply context-aware output encoding in templates and components.
• Enable strict CSP with nonces/hashes and remove unsafe-inline usage.
• Mark session cookies HttpOnly, Secure, and SameSite where appropriate.
• Audit DOM sinks like innerHTML and unsafe URL assignment.

Detection Signals

• Unexpected script tags, inline handlers, or javascript: URLs in user content.
• CSP violation reports with repeated blocked script execution attempts.
• User complaints of forced redirects or suspicious prompts.

Internal Resources

• Quiz
• Blog
• FAQ