Cross Site Scripting (XSS)

What is Cross Site Scripting ???

XSS or Cross Site Scripting is a mechanism that an attacker can client side scripts (called as malicious scripts) into the web page which is viewed by others. Basically XSS is a computer security vulnerability that which will be found at web applications.

How it works?

By leveraging XSS, an attacker does not target a victim directly. Instead, an attacker would exploit a vulnerability within a website or web application that the victim would visit, essentially using the vulnerable website as a vehicle to deliver a malicious script to the victim’s browser.

 

XSS takes the advantage of the fact that browser (markup language) can't tell the valid markup from the attacker-controlled markup. What it actually does is execute whatever markup text they receive. The attack circumvents the Same Origin Policy, intended to prevent scripts originating in one website from interacting with scripts from a different website.

This Same Origin Policy requires that all content on a web page come from the same source (Normally the same database). When the Same Origin Policy isn't enforced, an attacker is able to inject a script and modify the web page to suit their own purposes.

Types of XSS Attacks

• Stored XSS => also known as Persistent XSS. This occurs when the data provided by the attacker is saved by the server/system. This is the most damaging type of XSS attacks. For an example an attacker paste the script (also called as payload) as a comment on a web application.  
• Reflect XSS => also known as non-persistent XSS. This is the very basic type of web vulnerabilities. In here, the attacker has to deliver the payload to the victim. Therefore, the attacker's payload script must be part of the request which is sent to the web server and reflected back so the HTTP response includes the payload from the HTTP request (reflecting is happening XD).
• Self-XSS => this relies on social engineering, which means it tricks the victim into executing malicious JavaScript code into their browser.
• Mutated XSS => also called as mXSS. This will be happened when attacker injects something that seems like safe but rewrite and modified by the browser. These are very hard to find.
• DOM - based XSS => The DOM Based XSS vulnerability happens in the DOM (Document Object Model) instead of part of the HTML. The web application then reads the data from the DOM and delivers it to the browser. If the data isn't handled correctly, the attacker is able to inject a payload that will be stored as part of the DOM. The payload is then executed when the data is read back from the DOM.

Preventing Methods

It is hard to find whether you are vulnerable or not for XSS. So the best way is preventing from XSS rather finding XSS. 

• Input Validation : Validating input helps prevent XSS in forms because it stops a user from adding special characters into web page data entry fields by refusing the request.
• Sanitization : This prevention method scrubs the data clean of potentially executable characters, changing unacceptable user input to an acceptable format and ensuring the data received can't be interpreted as executable code.
• Encoding : In some cases it might be enough to encode the HTML special characters, such as opening and closing tags. In other cases a correctly applied URL encoding is necessary. 
• Escaping user Inputs :  Escaping user input prevents key characters in the data that a web page receives from being interpreted as executable code.