Cross Site Scripting (XSS)¶

An XSS vulnerability occurs when attackers can execute custom scripts on a victim’s browser. If an application fails to distinguish between user input and the legitimate code that makes up a web page, attackers can inject their own code into pages viewed by other users. The victim’s browser will then execute the malicious script, which might steal cookies, leak personal information, change site contents, or redirect the user to a malicious site. These malicious scripts are often JavaScript code but can also be HTML, Flash, VBScript, or anything written in a language that the browser can execute.

XSS is one of the most common web vulnerabilities, appearing in ~60-70% of applications (based on bug bounty reports and pentests). It can still be found everywhere because modern SPAs (React, Angular) introduce new XSS vectors (e.g., innerHTML, dangerouslySetInnerHTML), vulnerable JS dependencies (e.g., outdated jQuery) in third-party code, because DOM-Based XSS is hard to detect with static scanners and widespread misconfigurations (e.g. Poor CSP rules and lack of output encoding.