flâneur

Cross-Site Scripting (XSS) | Computer Security

textbook.cs161.org · 814 words · saved by 1 readers

XSS is a class of attacks where an attacker injects malicious JavaScript onto a webpage. When a victim user loads the webpage, the user’s browser will run the malicious JavaScript. XSS attacks are powerful because they subvert the same-origin policy. Normally, an attacker can only run JavaScript on websites they control (such as https://evil.com), so their JavaScript cannot affect websites with origins different from https://evil.com. However, if the attacker can inject JavaScript into https://google.com, then when a user loads https://google.com, their browser will run the attacker’s JavaScript with the origin of https://google.com. XSS attacks allow malicious JavaScript to run in the user’s browser with the same origin as a legitimate website. This allows the attacker to perform any action the user can perform at https://google.com or steal any user secrets associated with Google and send them back to the attacker. There are two main categories of XSS attacks: stored XSS and reflecte

Cross-Site Scripting (XSS) | Computer Security Skip to main content Menu Expand (external link) Document Search Copy Copied Computer Security 22. Cross-Site Scripting (XSS) XSS is a class of attacks where an attacker injects malicious JavaScript onto a webpage. When a victim user loads the webpage, the user’s browser will run the malicious JavaScript. XSS attacks are powerful because they subvert the same-origin policy. Normally, an attacker can only run JavaScript on websites they control (such as https://evil.com ), so their JavaScript cannot affect websites with origins different from https

saved by

related reading