| FAQ Article: What is Cross Site Scripting (css/xss) ? |
Ok, firstly - cross site scripting is commonly referred to as xss or css - but please do not get it mixed up with the cascading style sheets (used in web pages, and also referred to by the abbreviation css).
I am covering this topic, because although a lot of people have heard of it, usually from the term being mentioned in security/vulnerability advisories, there is definitely a lack of understanding when it comes to what it actually is, and why it occurs.
Cross site scripting, in a way, took a lot of major sites (Ebay, Google, all sites running phpnuke) and software developers by surprise when it emerged as a common flaw...and there are millions cross site scripting flaws still out there, and many new one's being created every day! To understand what cross site scripting (xss) is, we need to look at what makes it possible. xss affects two things:
- Web browsers (such as Internet Explorer, Netscape, Mozilla, Opera)
- Web servers that dynamically generate pages based on unvalidated input (most web servers)
Most web browsers have the capability to interpret scripts embedded in web pages downloaded from a web server. By this, we mean languages such as javascript (and also Java, VBScript, ActiveX, Flash, etc) which can be embedded in a standard html page, for example:
<html>
<head><title>My page</title></head>
<script>
alert("hello");
</script>
<body>
Welcome to my page on the web.
</body>
</html>
The javascript code embedded in the |
