Understanding XSS

Cross-Site Scripting (XSS) occurs when untrusted data is injected into a webpage without proper validation. It allows attackers to execute malicious scripts in users' browsers.

• Stored XSS: The malicious script is saved on the server (e.g., in a comment or DB) and triggers every time a user loads the infected page.
• Reflected XSS: The payload is part of the URL or request and reflected immediately in the response (e.g., search results).
• DOM-based XSS: The vulnerability exists in the frontend JavaScript logic, where user input is directly inserted into the DOM.
• document.write() XSS: Using document.write() without validation can lead to full control over page content.

🔐 Modern websites use input sanitization, escaping, and Content Security Policies (CSP) to prevent XSS.

Examples of payloads:

• <script>alert('XSS')</script>
• " onmouseover="alert(1)
• <img src=x onerror=alert(1)>