Web › Module 2 › Lesson 1
Cross-Site Scripting (XSS) Types
Reflected, stored, and DOM XSS—when the browser runs attacker JavaScript in your site's context
Visual · web_developer
XSS tricks a victim's browser into executing JavaScript as if it came from a trusted site—stealing cookies, hijacking sessions, or rewriting the page.
Opening
Your site becomes the attacker's script host
Cross-Site Scripting (XSS) is not cross-site in the sense of loading evil.com—it is attacker code running on your origin. Because the script runs with your site's privileges, it can read DOM data, call your APIs with the user's cookies, and phish inside a real URL bar. Three types show up in every web app assessment: reflected, stored, and DOM-based.
1. Reflected XSS
The malicious script is in the request—often a URL parameter or search box—and the server echoes it straight into the HTML response without encoding. The victim must click a crafted link (or submit a form) to trigger it. Common in error messages and search results pages.
Reflected payload concept (lab)https://lab.local/search?q=<script>alert(document.domain)</script> # If the page renders q unescaped inside HTML, script runs
https://lab.local/search?q=<script>alert(document.domain)</script> # If the page renders q unescaped inside HTML, script runs
2. Stored XSS (Persistent)
The payload is saved on the server—comments, profile bios, support tickets—and served to every visitor who views that content. One post can compromise many users without individual links.
3. DOM-Based XSS
The server may return safe HTML, but client-side JavaScript reads attacker-controlled input (location.hash, postMessage, innerHTML) and writes it into the DOM unsafely. No server-side echo required.
DOM XSS pattern (avoid in your apps)namegreetHello
namegreetHello
Impact when XSS fires in a logged-in session:
Session theft
document.cookie or fetch to attacker server (if not HttpOnly).
Account actions
XHR/fetch to change email, transfer funds, or admin settings.
Keylogging / phishing
Fake login overlay on a legitimate page.
Context matters for encoding
HTML entity encoding helps in HTML body text but fails in JavaScript strings or event handlers. Encode for the exact sink (HTML, attribute, JS, URL)—or better, avoid innerHTML entirely.
Knowledge Check
Stored XSS differs from reflected because:
Multiple choice
Knowledge Check
True or False: DOM XSS can occur without the server echoing the payload in HTML.
True or False
Knowledge Check
XSS is dangerous because scripts run with:
Multiple choice