The modern websites are more dynamic in nature than erstwhile websites, giving a whole lot of vibrant content and making the user experience more enjoyable. Dynamic contents can be developed using web based applications that deliver different output depending on the users and their settings.
Cross Site Scripting is a serious security vulnerability found in web based applications and it poses a threat to dynamic websites. It is otherwise known as a code injection attack executed on the client side web browser. Using Cross-site scripting, the client side scripts of web applications are manipulated to execute in a manner desired by the attacker. Here the attacker does not target a victim, but exploits the vulnerability in the website that the victim visits. To the victim the website code appears legitimate.
In XSS, attackers make use of any previously known vulnerability in the servers or the plug-in systems that they rely upon. XSS occurs with those websites that accept input from users and dynamically include them in the web pages without properly validating the same. Most specifically cross-site scripting is used to bypass access controls and also to impersonate users.
TYPES OF XSS ATTACKS
Persistent XSS Attack:
In this case, the attacker inputs malicious data to the website and it is stored permanently on the database or any other storage device. It has the highest impact as compared to other types of attacks, as it is targeted on every visitor of the application. Unless detected manually and removed, the malicious code remains active on the website and hence has a long term effect.
Non-Persistent XSS Attack:
It is the most commonly exploited form. Here, the malicious data uploaded by the hacker is used immediately. Even though the attack is mostly targeted it doesn’t have a wide impact.
IMPACT OF CROSS-SITE SCRIPTING VULNERABILITY
Taking advantage of the cross site scripting vulnerability, the attackers gain access to the logged in user’s session and his account credentials. Once the hacker gets admin privileges, then the adverse effect can be easily imaginable.
Thankfully, protecting websites against XSS attack is simple. Care must be taken right from the time of coding. The basic step in preventing XSS attack is not to trust data coming from any user or third party sources. Always ensure that every bit of data is validated. Data validation is an important step in preventing XSS attack to ensure that your sites are protected. If some data fails to pass the validation, the data has to be discarded. The next step to be taken is data sanitization. It focuses on ensuring that the data is safe by removing unwanted bits from the data input. Hackers are on the lookout for Cross Site Scripting (XSS). By validating, sanitizing and encoding the input before presenting it on the page, a developer can ensure that malicious users cannot inject any malicious code into the web pages. The key idea is to treat any external information as inherently untrustworthy.
