1. What is Cross Site Scripting?
Cross Site Scripting (or XSS) is one of the most common
application-layer web attacks. XSS commonly targets scripts embedded in a
page which are executed on the client-side (in the user’s web browser)
rather than on the server-side. XSS in itself is a threat which is
brought about by the internet security weaknesses of client-side
scripting languages, with HTML and JavaScript (others being VBScript,
ActiveX, HTML, or Flash) as the prime culprits for this exploit. The
concept of XSS is to manipulate client-side scripts of a web application
to execute in the manner desired by the malicious user. Such a
manipulation can embed a script in a page which can be executed every
time the page is loaded, or whenever an associated event is performed.
A basic example of XSS is when a malicious user injects a script in a
legitimate shopping site URL which in turn redirects a user to a fake
but identical page. The malicious page would run a script to capture the
cookie of the user browsing the shopping site, and that cookie gets
sent to the malicious user who can now hijack the legitimate user’s
session. Although no real hack has been performed against the shopping
site, XSS has still exploited a scripting weakness in the page to snare a
user and take command of his session.