XSS is a trick where a hacker hides computer instructions inside a website you trust. These instructions run inside your own browser instead of the website's main computer.

Introduction to XSS

Scripts are sets of instructions that make websites interactive, like showing a popup or updating a feed. Hackers use these same tools to perform actions you never asked for.

How Web Scripts Work

This happens when malicious code is saved permanently on a website, like in a comment or a user profile. Anyone who views that page later will accidentally trigger the hidden code.

The Stored Attack

In this attack, the code 'bounces' back to you through a deceptive link. If you click the bad link, the website echoes the hacker's instructions onto your screen.

The Reflected Attack

This attack stays entirely inside your browser window and doesn't even touch the website's server. It exploits how your browser handles information locally in its internal memory.

The Browser-Only Attack

Websites use 'cookies' as digital ID cards to remember that you are logged in. Hackers use XSS to steal these cards and gain full access to your account.

Stealing Digital Cookies

Once a hacker steals your digital ID, they can act exactly as if they were you. This allows them to read your private messages or even make purchases in your name.

Identity Theft and Hijacking

Hackers can use XSS to display a fake login box over a real website. If you type your password there, it goes directly to the hacker instead of the official site.

Fake Login Boxes

A hacker can use code to change the images, buttons, or text on a page. This is used to spread false information or make a trusted website look broken.

Changing Website Looks

To stay safe, developers must 'sanitize' or clean everything users type. This process removes any hidden computer commands before they can do any harm.

Cleaning User Data

Encoding turns dangerous code symbols into safe text versions that the browser won't run. This tells the browser to just display the characters rather than treating them as a command.

Transforming Symbols to Text

This is a rule-checking system that only allows specific types of information. For example, a box for a phone number should only accept numbers, never computer code.

Strict Data Rules

A Content Security Policy acts as a 'guest list' of which sources are allowed to run code. If a hacker tries to run a script that isn't on the list, the browser blocks it.

Trusted Source Lists

Developers can use a special setting to make digital ID cards invisible to scripts. This ensures that even if a hacker runs a successful attack, they cannot steal your login info.

Invisible ID Cards

The 'Samy Worm' was a famous attack that spread to a million social media profiles in less than a day. It demonstrated how quickly one small piece of hidden code can affect millions of people.

Meet the Samy Worm