XSS aka Cross Site Scripting is one of the strong enemies of developers. It ruins the whole app. Let me explain:

What’s XSS btw?

Imagine you have a magical input box on your website where users can leave comments. You as a developer expect a comment like this from your users:

But, uh-oh, someone leaves a comment like this:

XSS can make your website do funny and dangerous things. Look what happens when the bad code is executed:

Bad code:

<script>
alert("Uh-oh, XSS!")
</script>

The output of the bad code when it is entered as a comment:

Suddenly, a pop-up appears to the people while viewing comments! That's the trick of XSS - it can run any code it wants!

The Trouble with XSS

XSS can cause real trouble. An attacker could steal passwords or trick users into doing things they didn't mean to. It happens when bad hackers inject malicious code into your site, and innocent users execute it without being aware of it.

By exploiting XSS, bad guys can:

• Hijack user accounts.

• Steal sensitive user data.

• Deface the website.

• Redirect users to malicious sites.

• Manipulate website content.

Well done! you are an XSS king now. Haha, just kidding. You got a basic idea about XSS.

How XSS Attacks Happen:

The Attacker's Perspective:

Let's meet Mallory, a baaad hacker. Mallory loves exploiting XSS vulnerabilities and hacking victims.

Mallory visits websites. Finds weak spots. Injects malicious code to make things worse. Imagine Mallory as a clever attacker who earns by cheating people. He always looks for a way to pull off the ultimate trick.

The Victim's Perspective:

Now, let's introduce Alice, our victim user. Alice innocently visits the website. Alice doesn't know that a malicious code is lurking in the shadows.

Things get worse when Allice interacts with the website. And she becomes a victim of an XSS attack. Poor Alice, she had no idea what she was getting herself into!

All blame should be put on the developers for opening a door for the attacker Mallory.

Summary

So, in short, XSS is a JavaScript code injection on web applications. Attackers use vulnerable web apps to inject malicious javascript code or a script.

If the attackers could successfully input javascript code AND execute it on your application, then it means, your app is vulnerable to XSS.

Love this blog post? I created a comprehensive XSS prevention guide for developers. Grab it by joining my newsletter or DM me “XSS101” on LinkedIn here.