Attack that injects malicious scripts into trusted websites to execute in victims' browsers.
Cross-Site Scripting (XSS) injects malicious scripts into web pages viewed by other users. When victims load the compromised page, the script executes in their browser with access to cookies, session tokens, and page content. XSS can steal credentials, hijack sessions, redirect users to malicious sites, or modify page content. There are three types: Stored XSS (script saved on server), Reflected XSS (script in URL parameters), and DOM-based XSS (client-side manipulation). XSS consistently ranks in the OWASP Top 10 vulnerabilities.
Why It Matters
The DSC Perspective:
XSS enables attackers to act as legitimate users, stealing sessions and credentials. Web applications need proper input validation and output encoding. Content Security Policy (CSP) headers provide additional XSS protection.