Sin 7: Cross-Site Scripting

Overview of the Sin

Cross-site scripting (XSS) bugs are a form of security defect unique to web-based applications that allow user data tied to the vulnerable web servers domain, usually held in cookies, to be disclosed to a malicious third party. Hence the term cross-site: the cookie is transferred from a client computer accessing a valid, but vulnerable, web-server site to a site of the attackers bidding. At least, this is the most common type of attack using XSS. There is another kind of XSS attack that is somewhat like a web-site defacement attack, which is covered later in this chapter.

Note 

XSS bugs are often referred to as CSS bugs, but people tend to refer to cross-site scripting as XSS, because CSS usually refers to cascading style sheets.