Cross-Site Scripting (XSS) is a security attack that allows a hacker to inject malicious code into a trusted website. The code usually runs as JavaScript in the visitor’s web browser.

If a website does not properly check user input, an attacker can use XSS to steal login details, hijack user sessions, display fake content or redirect visitors to malicious websites.

How It Works

• A hacker submits malicious code through a website input, such as a comment box or search field.
• The website stores or displays the code without checking it.
• Another user opens the affected page.
• The malicious code runs in the user’s browser as if it came from the trusted website.

Common Uses

Although XSS is an attack rather than a legitimate technology, it is commonly seen in attacks against:

• Web applications
• Online forums and blogs
• E-commerce websites
• Banking websites
• Content management systems (CMS)
• Social media platforms

Related Entries

• Key Exchange
• Asymmetric Encryption
• TLS
• Cross-Site Scripting
• Asymmetric Encryption