July 26, 2026
XSS | Cross Site Scripting
Cross-site scripting (XSS): An injection attack that inserts code into a vulnerable website or web application.
By Prashant Rai
1 min read
Primarily includes three main types: Reflected XSS, Persistent XSS and DOM-based XSS.
Reflected XSS : The web application takes user input & immediately reflects it back in the response without proper sanitization. This allows to inject & execute JavaScript code in the victim's browser, potentially leading to cookie theft or other malicious actions.
Ex:- Welcome message input fields.
Persistent XSS : or Stored XSS or Second Order XSS involves injection malicious scripts that are saved on the server & served to all users visiting the affected page. It uses the victim's own system to deliver the malicious payload repeatedly.
Ex:- Comment input fields.
DOM-Based XSS : Document Object Model (DOM) XSS occurs when the web page's client-side code processes user input in an unsafe way, allowing JavaScript injection directly in the browser. The vulnerability arises from the web page source code that is returned to the browser, not from backend sever code.
