Cross Site Scripting (XSS) - Computer Science Higher Level (International Baccalaureate)

Courses Computer Science Higher Level Advanced Networking Cross Site Scripting (XSS)

Cross-Site Scripting (XSS)

Cross-Site Scripting (XSS) is a type of security vulnerability commonly found in web applications. It happens when an attacker manages to inject malicious scripts (usually JavaScript) into a website, which then runs in the browsers of other users.

Because the browser trusts content from the website, the injected script can perform actions like:

Stealing cookies or session data
Redirecting users to malicious websites
Displaying fake content or phishing forms
Performing actions on behalf of the user

Cross-Site Scripting (XSS) is a type of security vulnerability commonly found in web applications. It happens when an attacker manages to inject malicious [[scripts]] into a website, which then runs in the browsers of other users.

{"cloze_text": "Cross-Site Scripting (XSS) is a type of security vulnerability commonly found in web applications. It happens when an attacker manages to inject malicious [[scripts]] into a website, which then runs in the browsers of other users."}

Three main types of XSS

There are three main types of XSS. Each ends with a script running in a victim's browser, but the script comes from a different place.

Stored XSS: the script is saved on the server in a database and sent to every visitor.
Reflected XSS: the script is in the request, such as a URL, and the server echoes it straight back.
DOM-based XSS: the page's own client-side JavaScript writes untrusted data into the page.

Stored XSS

In stored XSS, the attacker's script is saved on the server, in a database, a comment, a forum post or a user profile. The server then serves it as part of the page to every visitor who views it.

This makes it the most dangerous type. One post can hit many users, and they do not have to click anything special. Just opening the page is enough.

In a stored XSS attack, where is the malicious script kept?

{"answers": {"A": "On the server, for example in a database, comment or forum post", "B": "Only in the URL of a link sent to the victim", "C": "In the page's own client-side JavaScript, without reaching the server", "D": "In the victim's browser history"}, "question_text": "In a stored XSS attack, where is the malicious script kept?", "correct_answer": "A"}

Why is stored XSS often seen as the most dangerous type of XSS?

{"answers": {"A": "It only works if the victim clicks a crafted link", "B": "It runs for every visitor who views the page, without them clicking anything special", "C": "It can only affect the website's administrator", "D": "It deletes the server's database automatically"}, "question_text": "Why is stored XSS often seen as the most dangerous type of XSS?", "correct_answer": "B"}

Reflected XSS

In reflected XSS, the script is part of the request, such as a URL parameter or a search box. The server echoes it straight back in the response, so it runs in the victim's browser.

The script is not stored anywhere. The victim usually has to be tricked into clicking a crafted link, often sent in a phishing email or message.

DOM-based XSS

In DOM-based XSS, the server response is fine. The problem is the page's own client-side JavaScript. It takes untrusted data, such as location.hash or a URL parameter, and writes it into the page.

If the code uses something like innerHTML, any script in that data runs. The whole attack happens inside the browser.

An attacker emails a link to a shop's search page. The link's search term contains a script, and the server copies the search term straight into the results page. Which type of XSS is this?

{"answers": {"A": "Reflected XSS", "B": "Stored XSS", "C": "DOM-based XSS", "D": "SQL injection"}, "question_text": "An attacker emails a link to a shop's search page. The link's search term contains a script, and the server copies the search term straight into the results page. Which type of XSS is this?", "correct_answer": "A"}

A page's JavaScript reads location.hash and writes it into the page using innerHTML. The server's response is unchanged. Which type of XSS is this?

{"answers": {"A": "DOM-based XSS", "B": "Reflected XSS", "C": "Stored XSS", "D": "Denial of service"}, "question_text": "A page's JavaScript reads location.hash and writes it into the page using innerHTML. The server's response is unchanged. Which type of XSS is this?", "correct_answer": "A"}

Where does a DOM-based XSS attack take place?

{"answers": {"A": "In the server's database, where the script is saved", "B": "Entirely in the browser, in the page's own client-side JavaScript", "C": "In the web server's log files", "D": "In the network router between the user and the server"}, "question_text": "Where does a DOM-based XSS attack take place?", "correct_answer": "B"}

The three types of XSS compared

How to Prevent XSS

Validate and sanitize user input to remove dangerous characters.
Escape output when displaying user-generated content on webpages.
Use security headers like Content Security Policy (CSP).
Avoid inserting untrusted data directly into HTML, JavaScript,

Example: a vulnerable comment page

Here is a vulnerable Python function. It builds HTML by joining a stored comment straight into the page, with no escaping:

def show_comment(comment):
    return "<p>" + comment + "</p>"

An attacker posts this comment as their payload:

<script>alert('XSS')</script>

The comment is saved, so the browser runs the script for every visitor who opens the page. A real attacker would swap the alert for code that steals session cookies.

Fixing the example

The fix is to escape the comment before it goes into the HTML, using html.escape():

Vulnerable	Fixed
def show_comment(comment): return "<p>" + comment + "</p>"	import html def show_comment(comment): return "<p>" + html.escape(comment) + "</p>"

The attacker's comment now comes out as:

&lt;script&gt;alert(&#x27;XSS&#x27;)&lt;/script&gt;

The browser now displays the text instead of running it. For DOM-based XSS, use textContent instead of innerHTML.

In the vulnerable show_comment example, which change stops the attacker's comment from running as a script?

{"answers": {"A": "Passing the comment through html.escape() before adding it to the HTML", "B": "Saving the comment in a different database table", "C": "Making the comment text bold", "D": "Adding more paragraph tags around the comment"}, "question_text": "In the vulnerable show_comment example, which change stops the attacker's comment from running as a script?", "correct_answer": "A"}

Question Type: fill in the blanks

{"paragraph": "In the vulnerable example, the function joins the [[comment]] straight into the HTML, so the browser [[runs]] the attacker's script for every visitor. Wrapping the comment in [[html.escape]]() converts special characters into HTML [[entities]], so the browser displays the payload as text instead of running it."}

To prevent XSS, it is important to [[validate]] and sanitize user input to remove dangerous characters.

{"cloze_text": "To prevent XSS, it is important to [[validate]] and sanitize user input to remove dangerous characters."}

In stored XSS, the malicious script is saved on the [[server]], so it is served to every visitor who views the page.

{"cloze_text": "In stored XSS, the malicious script is saved on the [[server]], so it is served to every visitor who views the page."}

In reflected XSS, the script is in the request and the server [[echoes]] it straight back in the response.

{"cloze_text": "In reflected XSS, the script is in the request and the server [[echoes]] it straight back in the response."}

DOM-based XSS happens entirely in the [[browser]], when client-side JavaScript writes untrusted data into the page.

{"cloze_text": "DOM-based XSS happens entirely in the [[browser]], when client-side JavaScript writes untrusted data into the page."}

To fix DOM-based XSS, use [[textContent]] instead of innerHTML so that untrusted data is treated as plain text.

{"cloze_text": "To fix DOM-based XSS, use [[textContent]] instead of innerHTML so that untrusted data is treated as plain text."}

{"keyword": "Stored XSS", "definition": "XSS where the malicious script is saved on the server, such as in a database or comment, and served to every visitor who views the page."}

{"keyword": "Reflected XSS", "definition": "XSS where the script is in the request, such as a URL parameter, and the server echoes it straight back in the response without storing it."}

{"keyword": "DOM-based XSS", "definition": "XSS where the page's own client-side JavaScript writes untrusted data into the page, so the whole attack happens in the browser."}

{"keyword": "Payload", "definition": "The malicious code an attacker injects, such as a script that runs in the victim's browser."}

{"keyword": "Content Security Policy (CSP)", "definition": "A security header that tells the browser which script sources are allowed to run, blocking injected or untrusted scripts."}

{"keyword": "innerHTML", "definition": "A JavaScript property that writes a string into the page as HTML, so any script tags in untrusted data can be run."}

Question Type: fill in the blanks

{"paragraph": "In [[stored]] XSS the script is saved on the server, for example in a database. In [[reflected]] XSS the script arrives in the request and is echoed back by the server. In [[DOM-based]] XSS the page's own client-side [[JavaScript]] writes untrusted data into the page."}

Question Type: short answer

{"answer": "Stored XSS saves the script on the server (e.g. in a database or comment) so it runs for every visitor who views the page. Reflected XSS puts the script in the request (e.g. a URL) and the server echoes it back without storing it, so the victim must be tricked into clicking a crafted link.", "rubric": {"0": "Incorrect or no response", "1": "Describes only one type correctly, or says one is saved and one is not without saying where the script comes from", "2": "Clear contrast: stored is saved on the server and hits every visitor; reflected is in the request/URL, echoed back, not stored, and needs the victim to click a crafted link"}, "question": "Explain the difference between stored and reflected XSS. (2 marks)"}