TechKnowSurge
TechKnowSurge Catalog Videos DEMO: Cross-Site Scripting (XSS)
VideoSecurityFree

DEMO: Cross-Site Scripting (XSS)

Cross-site scripting (XSS) is a web vulnerability that allows attackers to inject malicious scripts into web pages, which then execute in the browsers of unsuspecting visitors. It is cataloged under CWE-79 in the Common Weakness Enumeration database.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Cross-site scripting (XSS), identified as CWE-79 in the Common Weakness Enumeration database, is a class of web application vulnerability in which an attacker injects client-side scripts into web pages that are later viewed by other users. The vulnerability exists when a web application fails to properly neutralize user-supplied input before rendering it as part of a page, allowing arbitrary code to be embedded directly into the site's content. When a victim loads the affected page, the browser interprets and executes the injected script as though it were legitimate, trusted code. A common exploitation path involves submitting script payloads through input fields such as comment forms or search boxes, requiring no elevated privileges or special access on the attacker's part. The attack can be as straightforward as pasting a script tag into a text field that the application fails to sanitize before storing or reflecting the input back to users. The consequences of a successful XSS attack vary in severity but can be significant. Attackers may use injected scripts to deface a site by altering its visible content, undermine user trust, or hijack authenticated sessions by stealing session tokens and impersonating legitimate users. Beyond session theft, XSS payloads can serve as a delivery mechanism for malware, silently installing malicious software on a victim's machine, or redirect users to fraudulent or competing websites without their knowledge. Understanding how XSS works at a technical level is foundational to both secure web development and web application penetration testing.

What you'll learn

What's covered

Cross-Site Scripting (XSS)

Key terms

Cross-Site Scripting
XSS
Cross-Site Scripting is a web application attack in which malicious scripts are injected into trusted web pages and executed in the browsers of unsuspecting users, enabling session hijacking, credential theft, and unauthorized actions on behalf of the victim.
Session Hijacking
An attack in which a threat actor takes over an authenticated session by stealing or forging the session token, gaining unauthorized access to resources without needing the user's credentials.
Malware
Software specifically designed to disrupt, damage, or gain unauthorized access to a system.
Vulnerability
A weakness in a system, application, or process that can be exploited by a threat actor.
Exploit
A piece of software or technique that takes advantage of a vulnerability to gain unauthorized access or cause harm.
Threat Actor
An individual or group responsible for a security incident or attack.

Topics

Cross Site Scripting Web Security Session Hijacking Script Injection Cwe 79 Application Security

Transcript

Cross-site scripting in the CWE database

Just remember that this is for educational and ethical hacking purposes only. Never use this knowledge for illegal, malicious or unethical activity.

I'm at the common weakness enumeration website, and this is the database of all the weaknesses that are being tracked. What I'm going to do is expand all on these weaknesses. I'm going to do a find, and we're going to look for XSS.

So we see here there's a whole section here. This is the improper neutralization of input during web page generation, or cross-site scripting. It's associated with cross-site scripting number CWE-79. And as we can see, there's lots of variations underneath this. So one of the variations is basic XSS, and then we have a couple other XSS, but these are all variations of this top layer one, cross-site scripting.

How the attack works

Let's go ahead and open up this cross-site scripting and see what this looks like. It gives us a little visual of what cross-site scripting is.

So here we have an adversary. An adversary is getting into a website and leaving a message. The message is some sort of script that they're adding to this website. And now when somebody goes and visits this website, this script is going to get played for them, and so therefore their computer gets infected, or their computer gets compromised, or something about this connection gets compromised. So the adversary creates some sort of code and then inserts that on the website, and then when users visit that website, they activate that code, or they run that code.

One of the easiest ways to do this is visit a website that has some sort of comments box in it. Now, the comments box has to have this weakness, but then what happens is that the adversary inserts their code directly into this message box. As you can see, it's very easy to carry out this cross-site scripting. It's as simple as copying and pasting code into a comment box.

So now an unsuspecting victim visits the website. What happens is that this web page gets sent over to the browser on this user's computer, and it'll interpret everything that's on this page. Well, what's on this page? One of the things is some malicious code. So now the malicious code gets run inside that browser.

An example

Let's take a look at an example of this. Here I've got just a simple web form. It's just one input, name, and then I can hit submit. So I'm going to type in Andrew and hit submit here. What happens is this Andrew goes into this message here and it says hello Andrew.

But what happens when I submit some sort of code, some sort of data that needs to be run? In this case right here, we're doing a script alert and it says you've been hacked. This is just representative of maybe some sort of malicious code that we have. So I'm going to copy this script right here. I'm going to paste it into this input. And when I hit submit, it's actually going to reput this up and run it, in which case then I get this alert that gets popped up and it says you've been hacked. So I'll click on OK. That's just an example of this script that's running now on this site here that I have.

Why an adversary would do this

So why would an adversary want to do this? Well, for one, maybe they just want to attack the integrity of the website. Maybe they want to put up some of their own code, or maybe they're trying to hijack a user session, or inject malware, or do some sort of redirection.

Website integrity is maybe they're inserting this just to display things on the website and attack the integrity of that website, so therefore when a user goes and views this website, it just looks different, or something is off on the website.

Maybe the adversary is looking to do a session hijack. That is, the user visits this website, logs into this website, and then this code gets presented, and then this session goes to the adversary. Now the adversary can start manipulating and changing things as if they were this user.

Perhaps the adversary wants to infect the computer with some sort of malware. So if they put malicious code in here, then maybe it then gets installed on this user's machine.

Or an adversary could be setting up some sort of redirection. That is, the user visits the website, this malicious code then redirects them to a whole other website. So this could be maybe a competitor: a competitor wants to take business from their competition, and so they'll do a redirect, so now users are buying from this other website.

Here's the attack card on that. We've got cross-site scripting, or XSS, and this is when an attacker injects scripts into a web page to be viewed by other users. And so it's associated with CWE-79.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →