• XSS is where an attacker can inject javascript code into a webpage to perform a (malicious) action.

Reflected XSS

• Arbitrary JS is reflected off a server ( therefore not permanent)
• Done in scenarios like error pages, links where the payload can be passed as request and also be sent in response.
• EXAMPLE: Attacker sends a URL with a malicious payload and the victim clicks the link and the payload is executed.

Stored XSS

• When arbitrary JS is stored on a database and this JS is retrieved and displayed to a user.
• More dangerous than reflected because the payload is automatically passed and executed to a user.

An attacker can use JS to ➖

• Steal session cookies:

  • This would allow an attacker to access a user’s account

  STEALING A COOKIE

• Write Keyloggers:

  • This would allow an attacker to extract sensitive information from a user such as credit card details

• General Spam:

  • An attacker could just be a nuisance and ruin a user’s experience with a website by manipulating various elements on the page and more

Finding XSS

As mentioned above, your payload can be added to different aspects of a page. One common aspect is between HTML tags. For example, imagine that a username is added inside the paragraph tags like

*<p> username </p>*

While just entering <script></script> may work. We want to close the paragraph tags. We could use the payload

*</p><script>alert(document.cookie);</script><p>hi*