Cross-Site Scripting (XSS)

Cross-Site Scripting (XSS) is a vulnerability that allows an attacker to inject malicious scripts into web pages viewed by other users. When a victim's browser executes the injected script, the attacker can steal session tokens, redirect users, deface websites, or perform actions on behalf of the victim.

---

How XSS Works

XSS exploits the trust a user's browser places in the content received from a website. If a web application includes user-supplied data in its output without proper encoding, an attacker can inject JavaScript that the browser executes as if it were legitimate application code.

User Input (Malicious Script)
       │
       ▼
Web Application (includes input in HTML without encoding)
       │
       ▼
Victim's Browser (executes the script as trusted code)

---

Types of XSS