‫Cross-Site scripting, abbreviated as access, is one of the most common vulnerabilities of Web applications
‫caused by inadequate input and output validation.
‫It's an attack in which malicious scripts are injected into otherwise benign and trusted web sites.
‫Nexus attacks occur when an attacker uses a web application to send malicious code generally in the
‫form of a browser side script to a different end.
‫User flaws that allow these attacks to succeed occur when the web application uses input from a user
‫within the output it generates without validating or encoding it.
‫An attacker can use access to send a malicious script to an unsuspecting user.
‫The End Users browser has no way to know that a script should not be trusted and will execute the script
‫because it thinks the script came from a trusted source.
‫The malicious script can access any cookies, session tokens or other sensitive information retained
‫by the browser and used within that site.
‫These scripts can even rewrite the content of the HTML page.
‫Let's see the details on the different types of access.
‫Flaws reflected excess is also known as non persistent access.
‫These types of flaws occur when user input is immediately returned by a web application in an error
‫message, search result, or any other response that includes some or all of the input provided by the
‫user as part of the request.
‫Without that, data being made safe to render in the browser and without permanently storing, the user
‫provided data.
‫The attacker prepares the HTTP request and sends it to the victim.
‫For example, in a phishing email since the link is to a reliable website.
‫The victim does not suspect the link and clicks on the link, the application sends the output produced
‫using the input sent by the victim as a response of user request, the code sent and the response is
‫interpreted in the victim's browser.
‫So let's see the reflected excess in an example, we'll use dam vulnerable web application for this
‫example.
‫Go to the OWASP Broken Web Applications homepage, you can use the IP address of the OWASP virtual machine
‫or if you do find a domain name in slash, et cetera, slash host file, you can use that name as well.
‫Click the -- vulnerable web application link.
‫Log into the application using user slash user credential and go to excess reflected page.
‫So on this page, there is an input field asking the name of the visitor.
‫When we submit our name, the application says hello.
‫As you can see, the application produced an output using the user input.
‫Do examine if the application validates the input.
‫We submitted input, which includes a tag.
‫Dag is not displayed, there might be two reasons for it, either the tag is sanitized or it's interpreted
‫by the browser.
‫So go to page source and search the tag.
‫There it is, the input was not sanitized regularly.
‫Now, try to send some script code.
‫And the output contains the script, and the script is interpreted by the browser since the output is
‫not stored and just reflected by the server.
‫The attacker has to convince the victim to click on the link, which will cause the production of the
‫malicious output.