Lesson 6: XSS — When the browser runs the attacker's code
XSS (Cross-Site Scripting) is one of the most common web vulnerabilities and appears in the OWASP Top 10. In this attack, an attacker manages to inject JavaScript code into a page that runs in another victim's browser — not on the server. The attacker doesn't break into the server; they trick the vi
XSS is like writing a fake instruction on a public bulletin board. Everyone who reads the board follows the instruction without knowing a stranger wrote it.
- XSS (Cross-Site Scripting)
- A vulnerability where an attacker injects JavaScript code into a web page that runs in other users' browsers.
- Reflected XSS
- A type of XSS where the payload is in the URL and reflected directly back to the browser — affects only whoever clicks the malicious link.
- Stored XSS
- A type of XSS where the payload is stored in the database (e.g., in a comment) and runs for every user who views the page — much more dangerous.
- Cookie Theft
- An attack where malicious JavaScript sends the victim's cookie (session token) to the attacker's server, allowing the attacker to impersonate the victim.
- Content Security Policy (CSP)
- An HTTP header that defines which sources may load JavaScript, limiting XSS damage.
