Cross-Site Scripting

Cross-Site Scripting (XSS) is a security attack where someone adds harmful code to a website or web page. The code can then run in another user’s web browser.

XSS often targets websites that accept user input, such as comments, search boxes or online forms. A successful attack can allow an attacker to steal information, change what a page displays or perform actions as the affected user.

How It Works

• An attacker adds harmful code to a website.
• The website stores or displays the code without properly checking it.
• Another user opens the affected page.
• The user’s browser runs the harmful code.
• The attacker may gain access to information or perform unwanted actions.

Common Uses

• Attacking websites with poorly protected forms.
• Stealing login session information.
• Changing content displayed on a web page.
• Redirecting users to harmful websites.
• Testing website security.

Related Terms: Web Security, JavaScript, Browser Security, SQL Injection, Cross-Site Request Forgery, Session Hijacking, Malware, Input Validation, Content Security Policy, Web Application

Related Entries

• Cross-Site Scripting
• Steganography
• TLS