XSS Playground

Cross-Site Scripting (XSS) is one of the most prevalent and dangerous web application vulnerabilities, consistently appearing in the OWASP Top 10 security risks. XSS attacks occur when an application includes untrusted data in web pages without proper validation or escaping, allowing attackers to execute malicious JavaScript in other users' browsers. This XSS tutorial covers the fundamentals of stored XSS - the most dangerous variant - and its real-world impact on web application security.

Understanding Cross-Site Scripting

XSS vulnerabilities come in three main types. Reflected XSS occurs when malicious input is immediately returned in the page response, typically through URL parameters. Stored XSS is more dangerous because the malicious payload is saved in the application's database and executes every time a user views the affected page. DOM-based XSS exploits client-side JavaScript that processes untrusted data. In all cases, the core issue is the same: the browser cannot distinguish between the application's legitimate JavaScript and the attacker's injected code.

A successful XSS attack grants the attacker the ability to execute arbitrary JavaScript in the context of the victim's session. This enables session hijacking through cookie theft, keylogging to capture credentials, phishing by modifying page content, cryptocurrency mining, and redirecting users to malicious sites. Stored XSS on a popular page can affect thousands of users without any interaction beyond normal browsing.

Crafting XSS Payloads

XSS payload development is both a science and an art. Basic payloads like <script>alert(1)</script> serve as proof of concept, but real-world exploitation requires sophisticated techniques. Event handlers (onerror, onload, onfocus), SVG elements, data URIs, and JavaScript protocol handlers all provide execution contexts. When applications implement filters, attackers use encoding tricks, case variation, nested tags, and polyglot payloads to bypass defenses.

Preventing Cross-Site Scripting

Effective XSS prevention requires output encoding appropriate to the context (HTML, JavaScript, URL, CSS), Content Security Policy (CSP) headers to restrict script execution, input validation using allowlists, and modern framework auto-escaping features. HttpOnly cookie flags prevent session theft even if XSS occurs. Security teams should combine automated scanning with manual testing, as many XSS variants evade automated detection tools.