# XSS XSS (Cross Site Scripting) is a client-side code injection attack where an attacker can execute malicious scripts in the web browser. ### Impact * **Account Hijacking**: Attackers could steal session cookies and take over victim's session. It could lead to administrative access in case of an administrator account hijack. * **Credential Theft**: Theft of credentials such as passwords from a login page clone. * **Data Leakage**: Personally identifiable information (PII) such as credit card number, SSN, or any data stored in the browser could be accessed. * Redirect to malicious webpages, keylogging, downloading malware. * Access geolocation, webcam, miccrophone, and files on system. There are 3 types of XSS: * Reflected (Non-persistent) * Stored (Persistent) * DOM-based ## Reflected (Non-Persistent) When the payload is part of the request that is sent to the server and is reflected back in the response. For example, a website's dashboard greets the user by their username. If the username is not sanitized properly, it could execute JS code. ## Stored (Persistent) When the payload passed to the web application is stored on the server and executes when rendered elsewhere. For example, payloads could be saved as comments on a page and then when the comments are loaded, it could execute JS code. ## DOM-based DOM objects are manipulated to execute malicious code. This is an advanced attack as the payload never reaches the WAFs and executes on the client-side. For example, the "document.write(document.URL)" could be used to retrieve malicious contents of some malicious site and execute it. ## Entry Points Any user-controlled parameter such as: * Input fields * Host Headers, Referer * URL redirection * URI parameters * File Upload (File name) ## # Payloads ### Popular ```