Comprehensive Summary of XSS (Cross‑Site Scripting) Attacks and Defenses

Cross‑Site Scripting (XSS) Overview

Cross‑Site Scripting (XSS) is one of the most common web application security vulnerabilities, allowing attackers to inject malicious JavaScript into pages viewed by normal users. Executed scripts can hijack sessions, steal cookies, redirect users, display unwanted ads, or even compromise server‑side data.

Impact of XSS

Phishing and credential theft

Cookie theft and privacy breach

Session hijacking and unauthorized actions

Forced ad pop‑ups and traffic inflation

Website defacement and data manipulation

Facilitation of larger attacks such as DDoS or worm propagation

How XSS Works

When a web page fails to properly escape special characters like < and > , injected HTML tags can contain JavaScript that the browser executes. The vulnerability arises when user‑controlled input is reflected or stored without adequate sanitisation.

Injection Vectors

Any untrusted data source can be a vector, including:

User‑generated content (UGC)

Third‑party links

URL parameters

POST parameters

Referer header

Cookies (including sub‑domain injection)

Classification

Type

Storage Location

Injection Point

Stored XSS

Backend database

HTML

Reflected XSS

URL

HTML

DOM‑based XSS

Backend DB / Frontend storage / URL

Frontend JavaScript

Defense Summary

Server‑side: Properly escape or encode user input before inserting into HTML (e.g., convert < to &lt; ).

Client‑side: Use frameworks that automatically sanitise output and apply Content Security Policy (CSP) headers.

Additional measures: Set cookies with the HttpOnly flag, employ OWASP‑recommended libraries, and perform both backend and frontend validation.

Common Q&A

Q: How does XSS differ between GET and POST requests? A: The difference is minimal; the attack vector changes based on how the data is submitted.

Q: How to prevent stolen cookies from being used? A: Use short‑lived cookies or bind them to user‑specific data.

Q: What is the main difference between XSS and CSRF? A: CSRF relies on a logged‑in user performing unwanted actions without JavaScript, while XSS directly executes malicious scripts in the victim’s browser.

Q: Quick ways to mitigate XSS? A: Enable HttpOnly cookies, apply OWASP sanitisation APIs, and filter input on both front‑end and back‑end.

Q: How to encode special characters? A: Use libraries such as ESAPI to encode characters like < , > , and backslashes, converting them to numeric entities (e.g., &#x3C; ).

For further reading, see the referenced articles and the book “XSS Cross‑Site Scripting Attack Analysis and Defense”.