I thought the same when I first started learning. It's too overwhelming with all those tough terminologies, so let's go slow.

Cross Site Scripting simply is a web vulnerability where an attacker injects malicious JavaScript code and website accidentally treats it as code instead of an ordinary text.

To know about Cross Site Scripting, you must learn basic web development markup and programming language such as HTML and JavaScript.

In this blog, lets just do a minor XSS payload execution in a safe environment to learn how it actually works. The detailed explanation of payload will be written below. Don't miss it out! Also don't miss out the link embedded within words.

Step 1: Create a anything.html file and paste the payload below. You can use OCR to extract code or type manually.

Step 2: Open the file in web browser.

Step 3: First try entering anything in the input field. It should display that word.

Step 4: Now its time for the payload execution.

You can see the popup. This is the example for Reflected XSS. When malicious input is sent to website, it immediately reflects back the input into response.

Reflected XSS involves injecting malicious executable code into an HTTP response.

See? Its nothing complex! No need to be overwhelmed.

Depending on the vulnerability and the application's protections, this could potentially be used to:

• Perform actions as the victim
• Modify what the victim sees
• Steal sensitive information accessible to the page
• Trick the victim with a fake login form
• Abuse the victim's authenticated session

Now time to explain the JavaScript and Payload

From the code above:

document.getElementById("output").innerHTML = input;

• innerHTML tells the browser to interpret the supplied value as HTML.

For example, if the user enters:

Hello

The browser displays it as a heading instead of showing the

tags.