Cross-Site Scripting (XSS) and CSRF

Cross-Site Scripting (XSS) is a client-side injection vulnerability where an attacker injects malicious scripts into web pages viewed by other users. Unlike SQL injection, which targets the server, XSS targets the victim's browser. When the browser renders the attacker's script, it executes with the same privileges as legitimate page scripts — enabling session hijacking, credential theft, and malware delivery.

Reflected XSS occurs when malicious script is embedded in a URL and the server immediately 'reflects' it back in the HTTP response without proper encoding. The victim is tricked (often via a phishing link) into clicking the crafted URL, causing their browser to execute the attacker's script. Reflected XSS is non-persistent — it only executes when the victim clicks the malicious link.

Stored (persistent) XSS embeds malicious script in the application's database — for example, in a comment or forum post. Every user who views that content has the script executed in their browser, making stored XSS far more dangerous than reflected XSS. DOM-based XSS occurs entirely in the browser when client-side JavaScript reads attacker-controlled data from the DOM (e.g., the URL fragment) and writes it back to the page unsafely.

The primary defense against XSS is output encoding: convert special characters to their HTML entity equivalents (<, >, &) before rendering them in the browser. A Content Security Policy (CSP) header restricts which scripts may execute, providing an important secondary defense. Input validation (allowlisting) should also be applied on the server side.

Cross-Site Request Forgery (CSRF) exploits the trust a website has in an authenticated user's browser. An attacker tricks a victim's browser into sending an unwanted authenticated request to a site where the victim is logged in. Because the browser automatically attaches session cookies, the target server believes the request is legitimate. Common CSRF attacks transfer funds, change email addresses, or alter account settings.

Imagine a user is logged into their bank at bank.com. An attacker sends them an email with a hidden image tag: <img src='https://bank.com/transfer?to=attacker&amount=1000'>. When the email is opened, the browser automatically loads the image URL — sending the transfer request with the victim's bank session cookie attached. The bank processes it as a legitimate request.

The most effective CSRF defense is a CSRF token — a unique, unpredictable value embedded in every form and verified server-side. Because the attacker cannot read the token from a different origin (same-origin policy), forged requests lack a valid token and are rejected. The SameSite cookie attribute (SameSite=Strict or Lax) also prevents browsers from sending cookies in cross-site requests.

XSS and CSRF are often confused but attack different targets. XSS injects malicious script that runs in the victim's browser — exploiting the user's trust in the website. CSRF forges requests from the victim's browser to a trusted site — exploiting the website's trust in the user's browser. XSS can be used to steal CSRF tokens, effectively chaining the two vulnerabilities.

Cookie flags provide important XSS mitigations. The HttpOnly flag prevents JavaScript from accessing the cookie via document.cookie, making session token theft harder even if XSS is present. The Secure flag ensures cookies are only transmitted over HTTPS, preventing interception on unencrypted channels. Both flags should be set on all session cookies as a defense-in-depth measure.

Security testers identify XSS by injecting probe payloads into every input field, URL parameter, HTTP header, and JSON field. A simple probe is <script>alert(1)</script> — if an alert box appears, XSS is confirmed. Tools like Burp Suite automate XSS scanning, and OWASP ZAP provides free active scanning. DOM-based XSS requires browser-side JavaScript analysis rather than server response inspection.

XSS attacks have caused significant real-world damage. The Samy worm (2005) spread across MySpace in 20 hours by exploiting stored XSS to self-propagate to over one million profiles. XSS attacks can steal session tokens to fully hijack accounts, redirect users to phishing sites, deliver browser exploits (drive-by downloads), and modify page content to display false information to targeted users.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: XSS injects scripts into pages viewed by other users, CSRF tricks authenticated browsers into sending forged requests, and output encoding, CSP, CSRF tokens, and the SameSite cookie attribute are the primary defenses. Next up we explore broken authentication and insecure deserialization.