📋 What Is It?
Cross-Site Scripting (XSS) - XSS flaws occur whenever an application includes untrusted data in a new web page without proper validation or escaping, or updates an existing web page with user-supplied data using a browser API that can create HTML or JavaScript.
#7
OWASP Rank 2017
7%
Apps Tested
203K
Occurrences
⚠️ Common Exploits
- Reflected XSS: Inject malicious scripts in URLs
- Stored XSS: Store malicious scripts in database
- DOM-based XSS: Manipulate client-side DOM
- Session Hijacking: Steal session cookies
- Keylogging: Capture user keystrokes
🔴 Attack Flow
1. Attacker crafts malicious JavaScript payload
↓
2. Injects script into vulnerable input field
↓
3. Victim loads page with injected script
↓
4. Script executes in victim's browser
↓
5. BREACH: Session stolen or account compromised!
↓
2. Injects script into vulnerable input field
↓
3. Victim loads page with injected script
↓
4. Script executes in victim's browser
↓
5. BREACH: Session stolen or account compromised!
✓ Prevention Checklist
- Escape user input before rendering
- Use Content Security Policy (CSP) headers
- Validate and sanitize all user input
- Use framework auto-escaping features
- Set HTTPOnly and Secure flags on cookies
📌 Quick Reference
Risk Level: CRITICAL RISK
Year: OWASP Top 10 2017
Category: WEB
Ranking: #7 in 2017