Cross-Site Scripting (XSS)
XSS is a client-side injection weakness in which attacker-controlled content is interpreted as active script in another user’s browser context.
Mechanism
Untrusted data reaches an HTML, attribute, URL, or script-sensitive context without the correct contextual encoding or sanitization. Stored, reflected, and DOM-based variants differ in where the malicious content is introduced and processed.
Indicators to watch
CSP violations, unexpected script execution, modified DOM behavior, suspicious inline scripts, reflected parameters, and reports of altered page behavior can be indicators.
Concept diagram
Defensive controls
Use contextual output encoding, safe templating, framework auto-escaping, strict Content Security Policy, input validation, secure cookie flags, and DOM-safe APIs.
Recommended security control
Content Security Policy + OWASP ZAP
Test only with harmless markers in an isolated application you own.
Defense tool
The administrator has not attached a tool yet. This slot will show “Build Soon” until a link or file is configured.
All attack descriptions are for defensive education. Test scanning, traffic generation, interception, wireless testing, and vulnerable applications only on systems and networks you own or are explicitly authorized to assess.