Vulnerability Fixation
Cross Site Scripting (XSS) Attack

What Is XSS?

CWE: 79 CVE: 2019-3826
XSS is a web attack where malicious scripts are injected into trusted websites, enabling attackers to manipulate the site’s behavior, steal sensitive data like cookies, session tokens, or login credentials, and execute actions on behalf of legitimate users.

Such attacks can compromise user accounts, expose confidential information, spread malware, and severely damage both the website’s security and its reputation.

Attack

  • Reflected XSS: Script executes instantly on the same page (e.g., pop-up).
  • Stored XSS: Script is saved on the server and affects users later.
  • DOM-based XSS: Script modifies the web page’s DOM, altering user data or interface.
Impact

  • Account hijacking via stolen cookies.
  • Credential or data theft.
  • Forced download of malicious files.
  • Disrupted user experience.
Types of CAPTCHA:

  • Sanitize and validate all inputs (client & server side).
  • Use content security policies and strong firewalls.
  • Encode output and encrypt sensitive data.

Step - by - Step Video Guide

Also Read :