[go: up one dir, main page]
Scribd
Upload
39 views1 page

XSS

The document discusses Cross Site Scripting (XSS) attacks, which occur when malicious scripts are injected into otherwise benign websites. XSS attacks can access cookies, tokens or other sensitive information and rewrite page content. The document covers how to avoid, test for, and review code to prevent XSS vulnerabilities.

Uploaded by

Bharatesh
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
39 views1 page

XSS

The document discusses Cross Site Scripting (XSS) attacks, which occur when malicious scripts are injected into otherwise benign websites. XSS attacks can access cookies, tokens or other sensitive information and rewrite page content. The document covers how to avoid, test for, and review code to prevent XSS vulnerabilities.

Uploaded by

Bharatesh
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
You are on page 1/ 1

Cross Site Scripting (XSS)

Author: KirstenS
Contributor(s): Jim Manico, Jeff Williams, Dave Wichers, Adar Weidman, Roman, Alan
Jex, Andrew Smith, Jeff Knutson, Imifos, Erez Yalon, kingthorin, Vikas Khanna
Overview
Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious
scripts are injected into otherwise benign and trusted websites. XSS attacks occur
when an attacker uses a web application to send malicious code, generally in the
form of a browser side script, to a different end user. Flaws that allow these
attacks to succeed are quite widespread and occur anywhere a web application uses
input from a user within the output it generates without validating or encoding it.

An attacker can use XSS to send a malicious script to an unsuspecting user. The end
user’s browser has no way to know that the script should not be trusted, and will
execute the script. Because it thinks the script came from a trusted source, the
malicious script can access any cookies, session tokens, or other sensitive
information retained by the browser and used with that site. These scripts can even
rewrite the content of the HTML page. For more details on the different types of
XSS flaws, see: Types of Cross-Site Scripting.

Related Security Activities


How to Avoid Cross-site scripting Vulnerabilities
XSS (Cross Site Scripting) Prevention Cheat Sheet
DOM based XSS Prevention Cheat Sheet
OWASP Development Guide article on Data Validation
OWASP Development Guide article on Phishing
How to Review Code for Cross-site scripting Vulnerabilities
See the OWASP Code Review Guide.

How to Test for Cross-site scripting Vulnerabilities


See the latest OWASP Testing Guide article on how to test for the various kinds of
XSS vulnerabilities.

Testing_for_Reflected_Cross_site_scripting
Testing_for_Stored_Cross_site_scripting
Testing_for_DOM-based_Cross_site_scripting
Description
Cross-Site Scripting (XSS) attacks occur when:

Data enters a Web application through an untrusted source, most frequently a web
request.
The data is included in dynamic content that is sent to a web user without being
validated for malicious content.
The malicious content sent to the web browser often takes the form of a segment of
JavaScript, but may also include HTML, Flash, or any other type of code that the
browser may execute. The variety of attacks based on XSS is almost limitless, but
they commonly include transmitting private data, like cookies or other session
information, to the attacker, redirecting the victim to web content controlled by
the attacker, or performing other malicious operations on the user’s machine under
the guise of the vulnerable site.

Stored and Reflected XSS Attacks


XSS attacks can generally be categorized into two categories: stored and reflected.
There is a third, much less well-known type of XSS attack called DOM Based XSS that
is discussed separately here.

You might also like