What is cross-site scripting a.k.a. XSS?

Site Admin/Owner Joined: Aug 27, 2002 Posts: 17088

Here are some highlights from a most excellent paper on cross-site scripting a.k.a. XSS. Be sure to read the full paper at Only registered users can see links on this board! Get registered or login!

What Is Cross-Site Scripting

Chad Perrin - March 18th, 2008 wrote:

Cross-site scripting, also known as “XSS,” is a class of security exploit that has gotten a fair bit of attention in the last few years. Many users, and even Web developers, aren’t entirely clear on what the term means, however. I’ll explain cross-site scripting for you, so you will know where the dangers lie.

Types of cross-site scripting

Chad Perrin - March 18th, 2008 wrote:

There are currently three major categories of cross-site scripting. Others may be discovered in the future, however, so don’t think this sort of misuse of Web page vulnerability is necessarily limited to these three types: Reflected, Stored, and Local.

Protection Against Cross-Site Scripting

Chad Perrin - March 18th, 2008 wrote:

The most comprehensive way to protect your Web design from being exploited by cross-site scripting is to translate any and all special characters in user-provided input — even in URLs — into display entities, such as HTML entities. This applies not only to server-side code like PHP, Perl, and ASP.NET code, but also JavaScript that works with any user-provided input as well. This may interfere with the operation of Websites where users expect to be able to use HTML and XHTML in their input, such as for Website design helper applications — in which case more complex code may be needed to protect against malicious code. Such fine-grained filtering is just one side of an arms race against malicious security crackers, however, and cannot reasonably be 100% effective.

Protection Against Cross-Site Scripting

Chad Perrin - March 18th, 2008 wrote:

The single most effective means of avoiding cross-site scripting in Web development, however, is to design your website so that it does not require client-side code at all. That way, if your users want to turn off the JavaScript interpreters in their browsers, they can do so without losing the ability to make use of your Website. This does not protect against all forms of potential malicious input to your server, of course, and it does not actually limit the vulnerability of your website all by itself — but it does give visitors to your website the option of protecting themselves.

registered · Site Admin Joined: Jun 04, 2004 Posts: 6437

Very interesting - thanks!

registered · Posted: Wed Mar 26, 2008 7:29 pm

Of course, like probably many of you, I have about 4 - 5 different books in various stages of "read"... lol... One of the 4 that I currently have cracked open is "Cross Site Scripting Attacks: XSS Exploits and Defense" by Grossman, Hansen, Petkov, Rager and Fogie...

Excellent read if you get a chance.