Essential Guide

How to hone an effective vulnerability management program

A comprehensive collection of articles, videos and more, hand-picked by our editors

cross-site scripting (XSS)

Cross-site scripting (XSS) is a security exploit in which the attacker inserts malicious coding into a link that appears to be from a trustworthy source... (Continued)

Cross-site scripting (XSS) is a security exploit in which the attacker inserts malicious coding into a link that appears to be from a trustworthy source. When someone clicks on the link, the embedded programming is submitted as part of the client's Web request and can execute on the user's computer, typically allowing the attacker to steal information.

Web forms that dynamically return an error message including user input data make it possible for attackers to alter the HTML that controls the behavior of the form and/or the page. Attackers do this in a number of ways, for example by inserting coding into a link in a forum message or in a spam message. The attacker may use e-mail spoofing to pretend to be a trusted source.

Like other Web-based exploits, such as SQL injection, much of the blame for cross-site scripting is placed on the insecure applications that make it possible. Web server applications that generate pages dynamically are vulnerable to a cross-site scripting exploit if they fail to validate user input and to ensure that pages generated are properly encoded. A vulnerability that enables cross-site scripting is sometimes referred to as an XSS hole.

To protect against cross-site scripting, experts recommend that Web applications should include appropriate security mechanisms and servers should validate input as a matter of course.

See also: application security, phishing, session hijacking

This was first published in September 2010

Continue Reading About cross-site scripting (XSS)

Glossary

'cross-site scripting (XSS) ' is part of the:

View All Definitions

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

Essential Guide

How to hone an effective vulnerability management program

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

File Extensions and File Formats

Powered by:

SearchSOA

TheServerSide

SearchCloudApplications

SearchAWS

SearchBusinessAnalytics

SearchFinancialApplications

SearchHealthIT

Close