XSS/Cross site Scripting

Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications. XSS enables attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same-origin policy. For example, here is some JS code that can be executed via XSS:

<script>alert("HACKED BY FZPX OF HEROHACK")</script>

XSS vulnerable sites will also probably be vulnerable to SQLi too. You can either put the code in the url (index.php?catID=6<script>alert("HACKED BY FZPX OF HEROHACK")</script>) or in a box that requires user input, such as a search box. The two kinds of XSS attacks that will be covered in unit 2 are stored and reflected XSS. Reflected XSS isn't permanent, but stored is. While launching such attacks, use Edge or IE because Chrome's XSS Auditor will block a site with XSS code. One vulnerable site is kidshealth.org. Put your code in the search box. You can also use HTML code

-Provided By FZPX