Threat profile
Cross-site scripting (XSS)
A page includes attacker-controlled content as active code, so it runs in the visitor's browser with the site's permissions.
How it works
When user-provided text such as a comment or a profile name is placed into a page without being encoded for that context, the browser cannot tell it from the site's own script. The script can then act as the signed-in user inside that site. Three variants are common: stored, reflected and DOM-based.
What to look for
- Content you typed appears unchanged in a page's HTML source.
- Reports of pages redirecting or showing unexpected pop-ups.
- Content-security-policy violation reports from the browser.
What reduces the risk
- Encode output for the place it lands: HTML body, attribute, URL or script. Prefer frameworks that do this by default.
- Set a strict Content-Security-Policy that forbids inline scripts.
- Mark session cookies HttpOnly so scripts cannot read them.
- Sanitise any HTML you must accept with a maintained library.
Related tool
Sources
Related threats
This section is for defence and learning. Do not test systems you do not own or have written permission to test: unlawful access to an information system is an offence (Turkish Penal Code, Article 243).