> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/portswigger-web-academy/xss/what-is-xss.md).

# What is XSS?

XSS (Cross Site Scripting): Is a web security vulnerability that allows an attacker to manipulate a website to return malicious java script to users. You can confirm most kinds of XSS vulnerability by injecting a payload that causes your own browser to execute some arbitrary JavaScript.

{% hint style="info" %}
XSS is a client-side vulnerability that targets other application users, while SQL injection is a server-side vulnerability that targets the application's database.
{% endhint %}

* The alert() is most popular, however it's been blacklisted from Chrome
* Instead, print() is the ideal way to initially test XSS

There are 3 types of XSS:

* Reflected
* Stored
* DOM-Based XSS

### Reflected XSS 

This is the most common type of XSS attack. This happens when you inject a payload into a request, whether that's GET, POST, UPDATE, etc... 

Here is a simple example of a reflected XSS vulnerability:

`https://insecure-website.com/status?message=All+is+well. <p>Status: All is well.</p>`

The application doesn't perform any other processing of the data, so an attacker can easily construct an attack like this:

`https://insecure-website.com/status?message=<script>/*+Bad+stuff+here...+*/</script> <p>Status: <script>/* Bad stuff here... */</script></p>`

Now if a user uses the URL constructed by the attacker, they will be at risk of exposing their data as the script is running inside of the website. However, this isn't the same as Stored XSS. Unlike Stored, this is typically a one and done thing.

### Stored XSS

This happens when a website includes data that came from an untrusted source and stores that data for later HTTPs requests. This "untrusted" source can come within! This captures pretty much anywhere that you can send data, whether thats:

* Comments
* Posts
* Customer Order

Here is a simple example of a stored XSS vulnerability. A message board application lets users submit messages, which are displayed to other users:

`<p>Hello, this is my message!</p>`

The application doesn't perform any other processing of the data, so an attacker can easily send a message that attacks other users:

`<p><script>/* Bad stuff here... */</script></p>`

### DOM-Based XSS

DOM XSS is when client-side Javascript processes data from an unstrusted soruce in a vulnerable way. This happens at runtime, and is not an error with the server code.&#x20;

In the following example, an application uses some JavaScript to read the value from an input field and write that value to an element within the HTML:

`var search = document.getElementById('search').value; var results = document.getElementById('results'); results.innerHTML = 'You searched for: ' + search;`

If the attacker can control the value of the input field, they can easily construct a malicious value that causes their own script to execute:

`You searched for: <img src=1 onerror='/* Bad stuff here... */'>`

{% hint style="info" %}
DOM stands for Document Object Model. The HTML DOM (Document Object Model) is a structured representation of a [web page](https://www.geeksforgeeks.org/websites-apps/web-page-a-complete-overview/) that allows developers to access, modify, and control its content and structure using [JavaScript](https://www.geeksforgeeks.org/javascript/javascript-tutorial/). It powers most dynamic website interactions, enabling features like real-time updates, form validation, and interactive user interfaces.

The DOM connects your webpage to JavaScript, allowing you to:

* Access elements (like finding an \<h1> tag).
* Modify content (like changing the text of a \<p> tag).
* React to events (like a button click).
* Create or remove elements dynamically.\
  ![](/files/kMQ9r5y51Yl25heAqkQm)
  {% endhint %}

{% hint style="info" %}

### DOM-based cross-site scripting <a href="#dom-based-cross-site-scripting" id="dom-based-cross-site-scripting"></a>

DOM-based XSS (also known as DOM XSS) arises when an application contains some client-side JavaScript that processes data from an untrusted source in an unsafe way, usually by writing the data back to the DOM.\
\
The reason why your client-side code is different because your client-side code is the result of the server-side code. The HTML, CSS, JS, is all generated from the server-side code. This is also why you can always see the front end code, but never the backed code.&#x20;
{% endhint %}