Cross-Site Scripting Attack

XSS attacks use third-party web resources to run scripts in the victim’s web browser or scriptable application.

Specifically, the attacker injects a payload with malicious JavaScript into a website’s database. When the victim requests a page from the website, the website transmits the page, with the attacker’s payload as part of the HTML body, to the victim’s browser, which executes the malicious script.

For example, it might send the victim’s cookie to the attacker’s server, and the attacker can extract it and use it for session hijacking.

Mitigations For Cross-Site Scripting:

1. Whitelist values.

2. Escape Dynamic content.

3. Sanitize HTML.

4. Implement a content security policy.

5. Giving users the option to disable client-side scripts.