Glossary
CROSS-SITE SCRIPTING / XSS
defined.
A vulnerability where attacker-controlled JavaScript runs in another user’s browser session, enabling cookie theft, session hijack, or arbitrary actions as the victim.
A–Z
A vulnerability where attacker-controlled JavaScript runs in another user’s browser session, enabling cookie theft, session hijack, or arbitrary actions as the victim.
Three flavours: reflected (payload echoed back in a response), stored (payload saved server-side and served to other users), and DOM-based (payload triggered entirely client-side by JavaScript writing to innerHTML).
Defence: output encoding by context (HTML body vs. attribute vs. JS), CSP with strict-dynamic, and Trusted Types in modern browsers.
See our web application penetration testing, API security testing, network penetration testing, and cloud security audit services for how we test for and defend against this class of issue.
30-minute call with an OSCP-certified engineer. Tailored proposal in 24 hours.