Tools / Cyber Security Interview Questions
What is Cross-Site Scripting (XSS)?
Cross-Site Scripting is a web vulnerability where an attacker injects malicious JavaScript into a page viewed by other users, letting the script run in their browser under the trust of the vulnerable site.
| Type | Description |
| Stored XSS | Malicious script is saved on the server, e.g. in a comment, and served to every visitor |
| Reflected XSS | Script is embedded in a request, e.g. a URL parameter, and reflected back in the response |
| DOM-based XSS | Script executes purely through client-side JavaScript manipulating the page's DOM |
Because the script runs as the victim in their own browser, it can steal session cookies, log keystrokes, or redirect the page. Escaping output and setting a strict Content Security Policy are the main defenses.
What can XSS allow an attacker to steal from a victim's browser?
Which XSS type saves the malicious script permanently on the server?
More Related questions...
