Cross-Site Scripting, Explained

One of the most common website attacks that most businesses have never heard of.

By: Brand Barney

How does cross-site scripting work? Here’s an example of one type of XSS.

• The hacker finds a legitimate webpage with an input field. Input fields could range from a first name field to a credit card field. 
• The hacker checks if the webpage is vulnerable to cross-site scripting. For this type of attack to work, the web application must use the data the user enters and echo it back to the user. For example, if you sign in with your username (say, example123) and the webpage says something like, “Welcome example123!”, that webpage is echoing your data back to you.
• The hacker embeds malicious script. Based on the JavaScript they enter in the comments fields, hackers can capture the keystrokes of the user, steal usernames or passwords entered into the fields, or even copy the entire webpage and redirect users to a fake webpage. 
• The hacker sits back and waits. When a user visits the web page (usually through a bad URL), the JavaScript executes on his or her browser (stealing all manner of sensitive data). Users usually have no idea this is happening. 

XSS is a huge flaw in many websites if left untested and not properly avoided.Tweet

How to stop cross-site scripting on your website

• Run external vulnerability scans. Vulnerability scans help locate coding errors where XSS vulnerabilities may occur.
• Talk to your web developer and make sure your site is properly coded with security in mind.