Academic Year: 2025-26 Name of Student:
Semester: VII Student ID:
Class / Branch/ Div: BE- IT/A Roll No.
Subject: SAD Lab Date of Submission:
Name of Instructor:
Experiment No: 06
1. Aim: To study Cross-Site Scripting (XSS) vulnerability lab.
2. Theory:
• Cross-site Scripting (XSS)-
Cross-site Scripting (XSS) is a client-side code injection attack. The attacker aims to
execute malicious scripts in a web browser of the victim by including malicious code
in a legitimate web page or web application. The actual attack occurs when the victim
visits the web page or web application that executes the malicious code. The web page
or web application becomes a vehicle to deliver the malicious script to the user’s
browser. Vulnerable vehicles that are commonly used for Cross-site Scripting attacks
are forums, message boards, and web pages that allow comments.
A web page or web application is vulnerable to XSS if it uses unsanitized user input in
the output that it generates. This user input must then be parsed by the victim’s browser.
XSS attacks are possible in VBScript, ActiveX, Flash, and even CSS. However, they
are most common in JavaScript, primarily because JavaScript is fundamental to most
browsing experiences.
• What Can the Attacker Do with JavaScript?
XSS vulnerabilities are perceived as less dangerous than for example SQL Injection
vulnerabilities. Consequences of the ability to execute JavaScript on a web page may
not seem dire at first. Most web browsers run JavaScript in a very tightly controlled
environment. JavaScript has limited access to the user’s operating system and the user’s
files. However, JavaScript can still be dangerous if misused as part of malicious
content:
Malicious JavaScript has access to all the objects that the rest of the web page has access
to. This includes access to the user’s cookies. Cookies are often used to store session
Department of Information Technology | APSIT
tokens. If an attacker can obtain a user’s session cookie, they can impersonate that user,
perform actions on behalf of the user, and gain access to the user’s sensitive data.
JavaScript can read the browser DOM and make arbitrary modifications to it. Luckily,
this is only possible within the page where JavaScript is running.
JavaScript can use the XMLHttpRequest object to send HTTP requests with arbitrary
content to arbitrary destinations.
JavaScript in modern browsers can use HTML5 APIs. For example, it can gain
access to the user’s geolocation, webcam, microphone, and even specific files from the
user’s file system. Most of these APIs require user opt-in, but the attacker can use social
engineering to go around that limitation.
The above, in combination with social engineering, allow criminals to pull off
advanced attacks including cookie theft, planting trojans, keylogging, phishing, and
identity theft. XSS vulnerabilities provide the perfect ground to escalate attacks to more
serious ones. Cross-site Scripting can also be used in conjunction with other types of
attacks, for example, Cross-Site Request Forgery (CSRF).
There are several types of Cross-site Scripting attacks: stored/persistent XSS,
reflected/non-persistent XSS, and DOM-based XSS. You can read more about
them in an article titled Types of XSS.
• How Cross-site Scripting Works-
There are two stages to a typical XSS attack:
1. To run malicious JavaScript code in a victim’s browser, an attacker must first
find a way to inject malicious code (payload) into a web page that the victim
visits.
2. After that, the victim must visit the web page with the malicious code. If the
attack is directed at particular victims, the attacker can use social engineering
and/or phishing to send a malicious URL to the victim.
Conclusion-
Hence, we learned what is XSS and how it works. Cross-site scripting vulnerabilities
remain one of the major causes of online attacks. Most of the vulnerable areas include
search and login pages that return a response or an error message to the browser – as
well as comment fields that allow script tags.
Department of Information Technology | APSIT
