Academy
TermAttack

Cross-site scripting

(XSS)

An attacker’s script running in other users’ browsers because a web application places user input on the page without sanitising it.

Flow

  1. 1An input is found
  2. 2A script is injected
  3. 3It runs on the victim
Related families
—
MITRE ATT&CK
T1189 · Drive-by Compromise
Sources
4 sources
01

Overview

According to OWASP, XSS is an injection flaw that lets an attacker add a malicious script to a trusted site. The script runs in the victim’s browser with that site’s privileges. OWASP

Its impact ranges from stealing the session cookie to changing the page content; cookies that scripts can access can be sent to the attacker this way. OWASP

02

How it works

  1. 1

    An input is found

    A search box, comment field or URL parameter. OWASP

  2. 2

    A script is injected

    The unsanitised input ends up on the page as a script. OWASP

  3. 3

    It runs on the victim

    The browser of the user who opens the page runs the script. OWASP

03

How to detect it

  • Requests in application logs containing script tags and event handlers. OWASP
04

What to do

  • Encode output according to its context; validate input. OWASP
  • Apply the HttpOnly flag and a content security policy to session cookies. OWASP
05

MITRE ATT&CK

T1189Drive-by CompromiseT1539Steal Web Session Cookie
06

Related terms

Terms

Session hijackingWeb skimmingJavaScript-based stealers
07

Sources

  1. 1Drive-by Compromise (T1189) · MITRE ATT&CK
  2. 2Steal Web Session Cookie (T1539) · MITRE ATT&CK
  3. 3Cross Site Scripting (XSS) · OWASP
  4. 4Cross Site Scripting Prevention Cheat Sheet · OWASP