What is Cross Site Scripting - Explained

Cross Site Scripting, in short form called as XSS which is a computer security vulnerability found in web applications/sites. This XSS enables a hacker(cracker) to inject malicious scripts in to web sites which can effect the users of the web site. So in this article we will try to know what is XSS(in more detail) and who hackers conduct the operation.


What is XSS: As its said before XSS is a computer security vulnerability found in web sites. This XSS allows attacker to bypass restrictions imposed by the web browsers to sensitive page content, cookies and a wide verity of information stored by the browser on behalf of user. XSS attacks are mostly done on web sites which do not validate the incoming data which in-turn executed on clients computer(mostly a malicious JavaScript) to steal the data or redirect to another malicious website or to embed a browser exploit.

How does it effect users: XSS very dangerous and can be a worst nightmare to you guys because, assume that you had visited a website called wax.com which has been infected by a malicious JavaScript inserted through XSS vulnerability by an hacker. What happens now is, the malicious JavaScript is activated in background and copies your cookies and other confidential data stored by your web browser.
The hacker uses the cookies which contains your session IDs and other crucial information to hack your email, paypal or other accounts which becomes a big disaster for you.

Image Courtesy acunetix.com

Not only these but hackers try to achieve the following information
» Identity Theft
» Access sensitive/restricted information
» Changing Browse functionality
» Web application defacement
» Access to paid content for free by stealing your passwords or cookies
» Denial of service attacks

How hackers conduct XSS attack: Assume that some guy named Varun(intruder) has visitedwax.com and he jealous of the development and traffic of wax.com. Now he wanted to steal some traffic, So he tried to find some vulnerability and got succeeded by founding thatwax.com allows comments under post with no validity. So Varun(intruder) made a comment some thing like this

Hey!! good post dude, keep the teast same B) <img src="http://www.xyz.com/image.png" onload="window.location='http://www.mywax.com'">

That's it, when ever the post is loaded it will be redirected to the malicious site mywax.comwhich is owned by Varun(Intruder).
The example shown above is just a tip of mountain and pro hackers can do even more worst things.

Prevention: Web-master's should take care that their websites are properly validating all the input data given by user and can also impose some restrictions on users to insert only some specific tags which you think your are OK with it. Webmaster should conduct regular security audits too.