In a cross site exploit, the attacker finds a way to cheat a security rule that browsers are supposed to enforce, namely that everything that executes on a Web page has to come from the same source (generally, the Web site the visitor is currently looking at). Vulnerable web pages, which may be referred to as XSS holes, allow the attacker to insert malicious code into a user input field. If a visiting client's browser is not up-to-date with the latest XSS filters, the malicious code will be delivered unfiltered and the browser will execute the malicious script when it loads the page. Typical XSS exploits allow the attacker to hijack the user's session, redirect the user to a malicious website, manipulate what is displayed in the victim's browser or steal data and credentials.
Web server applications for large sites that aggregate code from multiple websites and generate Web pages dynamically are most vulnerable to cross-site scripting exploits because it can be difficult to validate code from multiple sources in a timely manner. When an XSS attack payload is injected into one application but reveals its presence in another Web application, it is called a distributed XSS attack.
To protect against cross-site scripting exploits, experts recommend that enterprises and individuals make sure they are using the latest version of their browser. Server administrators should validate input as a matter of course; there are many XSS filtering applications to help them do so.
Continue Reading About cross-site scripting (XSS)
Margaret Rouse asks:
How dangerous are XSS exploits in today's world?
1 ResponseJoin the Discussion