XSS

Cross-Site Scripting (XSS) is a security vulnerability in web applications where attackers inject malicious scripts into web pages viewed by other users. There are three main types of XSS:

1. Stored XSS:

   • Malicious scripts are permanently stored on the target server, impacting all users who view the affected page. Example: Attacker injects a script into a comment on a website, and anyone viewing that comment becomes a victim.

2. Reflected XSS:

   • Malicious scripts are embedded in a URL and only affect users who click on a specially crafted link. Example: Attacker sends a phishing email with a link containing a script, and users who click on the link inadvertently execute the script.

3. DOM-based XSS:

   • The attack occurs in the Document Object Model (DOM) of a web page. Malicious scripts manipulate the DOM, leading to undesired outcomes. Example: Attacker injects a script that modifies the page's content directly through client-side scripting.

Preventing XSS involves input validation, output encoding, and implementing security mechanisms like Content Security Policy (CSP) to mitigate the risk of script injection attacks.

Resources:

• https://owasp.org/www-community/attacks/xss/

• https://en.wikipedia.org/wiki/Secure_cookie

• https://en.wikipedia.org/wiki/Session_(computer_science)

• https://en.wikipedia.org/wiki/HTTP_cookie

• https://www.youtube.com/watch?v=bkDIdVNbLNI