Cross-site scripting, usually called XSS, happens when an attacker gets a website to run unwanted code in someone else’s browser. The basic idea is simple. The tricky part is that XSS doesn’t always happen in the same way.<\/p>\n
Stored XSS is the one I take most seriously because the harmful code gets saved by the website itself. Imagine a comment section where someone enters something that looks like normal text. If the site stores it without properly handling the input, the code can later run whenever another person opens the affected page.<\/p>\n
Think about a forum or profile page. Raj once spent a morning checking why a test comment kept appearing after he refreshed the page. He stopped reopening the same five tabs every morning once he found the stored input causing it.<\/p>\n
Reflected XSS works differently. The malicious input usually arrives as part of a request and is immediately reflected back into the webpage without proper handling. A specially crafted link is a common way this happens.<\/p>\n
Because the code isn’t normally saved on the server, the attacker has to get the victim to make the affected request. A fake message containing a strange-looking link could do the job.<\/p>\n
Search pages are a classic example. A site might display the search term on the results page. If that value is inserted into the page without safe output handling, an attacker can try to manipulate what the browser receives.<\/p>\n
\u2022 A search result page that repeats the user’s query, for example, can become risky if that value isn’t handled safely.<\/p>\n
\u2022 A URL carrying unwanted input is another common route, although the victim still has to open the affected request.<\/p>\n
DOM-based XSS has a different twist. The problem exists mainly in the browser-side code that changes the page using data it doesn’t trust.<\/p>\n
JavaScript might read something from the URL and then place that value into the page. If the code uses an unsafe method to insert it, the browser can interpret attacker-controlled content as HTML or script.<\/p>\n
And this is why looking only at the server isn’t enough. A website can have perfectly reasonable server responses while its client-side JavaScript still creates an XSS problem.<\/p>\n
These categories describe how the malicious input travels, rather than three completely separate vulnerabilities. Stored XSS involves saved input. Reflected XSS sends the input back through a request. DOM-based XSS comes from unsafe handling in browser-side code.<\/p>\n
The practical defenses are less mysterious than the names suggest. Treat user input as untrusted. Encode output for its actual context. Use safe DOM APIs where possible. And add protections such as a strong Content Security Policy as another layer.<\/p>","protected":false},"excerpt":{"rendered":"
Cross-site scripting, usually called XSS, happens when an attacker gets a website to run unwanted code in someone else’s browser….<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[31],"tags":[],"class_list":["post-4192","post","type-post","status-publish","format-standard","hentry","category-learn"],"_links":{"self":[{"href":"https:\/\/cybx.in\/blog\/wp-json\/wp\/v2\/posts\/4192","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cybx.in\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybx.in\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cybx.in\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/cybx.in\/blog\/wp-json\/wp\/v2\/comments?post=4192"}],"version-history":[{"count":1,"href":"https:\/\/cybx.in\/blog\/wp-json\/wp\/v2\/posts\/4192\/revisions"}],"predecessor-version":[{"id":4243,"href":"https:\/\/cybx.in\/blog\/wp-json\/wp\/v2\/posts\/4192\/revisions\/4243"}],"wp:attachment":[{"href":"https:\/\/cybx.in\/blog\/wp-json\/wp\/v2\/media?parent=4192"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybx.in\/blog\/wp-json\/wp\/v2\/categories?post=4192"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybx.in\/blog\/wp-json\/wp\/v2\/tags?post=4192"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}