Cross-Site Scripting

Cross-site scripting or XSS attacks involve malicious scripts that have been injected into a trusted site.

XSS attacks occur when an attacker exploits a given web application that allows unventilated input to be sent to the site, generally in the form of browser-based scripts, which are then executed by a different user of the website.

There are many forms that attackers can exploit, based on validated or unencoded information provided to websites.

XSS can be described by the following sequence diagram:

Figure 15.1 – Cross-Site Scripting (XSS)

At the core of this issue is expecting a user to trust the site’s information that is being sent. The end user’s browser has no way of knowing that the script should not be trusted because there is implicit trust in the website they’re browsing. Because the end user thinks the script came from a trusted source, the malicious script can access any cookies,...