Cross-Site Scripting (XSS) attacks are still very common today. It is a type of injection attack where an attacker injects malicious scripts or code into requests sent by the web application. These attacks succeed due to user input not being validated correctly before it's sent to the server.
There were initially two types of XSS, but, in 2005, a third was discovered:
- Stored XSS: Storage XSS occurs when the user input is stored on the target server and is not validated. The storage can be a database, forum, or comment field. The victim unknowingly retrieves the stored data from the web app, which the browser thinks is safe to render because of the inherent trust between the client and server. Because the input is actually stored, Stored XSS is considered to be persistent or permanent.
- Reflected XSS: Reflected XSS occurs when user input is immediately...
