Cross Site Scripting

Published on
24 Jun 2018
3 min read

Cross-site Scripting (XSS) is a client-side code injection attack. Using this technique, an attacker can execute malicious scripts into a legitimate website or web application. This server has a vulnerability that allows an attacker to send malicious code to the user. A browser cannot foresee the script on the website. So, it cannot judge if a website should be trusted or not. The browser will execute the script allowing the attacker to access any cookie or session token retained by the browser.

An attacker can use the XSS attack to send a malicious script to the end user. The end user doesn’t know if the source of the script is legit or not and the user still executes the script. Due to this irresponsible move, the end user will allow the attacker to access any cookies, session tokens, or other sensitive information retained by the browser. The attacker will use this information to intensify the attack. These scripts can do any changes in the application and worst case; this attack can change the content of the HTML page.

Type of Cross-site Scripting (XSS)


The below code is vulnerable to cross-site scripting.

        print "<html>"
        print "<h1>Most recent comment</h1>"
        print database.latestComment
        print "</html>"


Consider the below error page. This page is displayed for 404 not found error. This handles the requests using PHP.

        <? php
        print "Not found: " . urldecode($_SERVER["REQUEST_URI"]);


The attacker will try to execute a non-existing URL.


The following result is the usual output for these requests.

Not found: /file_which_not_exist

The attacker will request the below code to execute the attack.<script>alert("TEST");</script>


An XSS vulnerable site will give the below output for the above URL input.

        Not found: / (but with JavaScript code <script>alert("TEST");</script>)


The above result shows that the attack was successful. The attacker can access sensitive data through session cookie using this method.


The issues include:-

  • Data corruption
  • Data Breach
  • The complete shutdown of the server

Mitigation / Precaution

Beagle recommends the following fixes:-

  • The application should filter metacharacters from user input.
  • Update plugins to latest versions.
Automated human-like penetration testing for your web apps & APIs
Teams using Beagle Security are set up in minutes, embrace release-based CI/CD security testing and save up to 65% with timely remediation of vulnerabilities. Sign up for a free account to see what it can do for you.

Written by
Co-founder, Director
Find website security issues in a flash
Improve your website's security posture with proactive vulnerability detection.
Free website security assessment
Experience the power of automated penetration testing & contextual reporting.