Explaining Of Cross-Site-Scripting

0xBen
3 min readNov 28, 2022

Hello guys , Before we start keep in your mind this is beginner to intermediate Level Xss

What is Xss?

is a type of injection attack allows an attacker to inject a malicious code in any user inputs that not validated .

Types Of Xss :

1- Stored (persistent ) Xss : this type gets stored in server and malicious code gets run every time users visit the site or vulnerable section

2- Reflected (Non-Persistent) Xss : this type not gets stored in a server and you must send malicious link to victim for example to steal cookies

3- Dom Xss : this type variety from Reflected and Stored Because can not be Stopped by the server and this type related to Source and sinks (js functions and properties) you can search about them to get more info …

Note : Dom( Document object model) : a web browser representation of elements of web page So when your Browser receives page to load it will parse it and became a Document object

How Exploit Xss In general ?

You need to determine where the inputs or values ( parameters ) are reflected .
Ex .. let’s suppose that The ULR is: https://example.com/customers?name=BenSaad

So the previous Ex The ? indicates to the start of parameter (Query String) and name indicates to parameter name or (key) AND BenSaad is the value So we are going to focus on value …… Don’t worry, i’ll explain this

As you can see When i set a value for “a” Welcome BennSaad .. i noticed that our input reflected “ Hello , Welcome BennSaad”

So , We must determine Where is our input is reflected so i will go to view source page …

As you can see our input ( Hello , Welcome BennSaad ) reflected inside Html tag so i will try … <img src=Y onerror=alert(“BenSaad”)> and this called payload

<img> this is html tag used to get image and src is Attribute

So our image source here is Y and can not find this source to load this image so when it happened i used onerror and called js event handler and used when an error occurs ….. So here can not find source Y And that’s Error, and I asked it when something went wrong use alert() to pop up BenSaad …

As you can see above pop-up BenSaad

Thank you and I hope this write-up is clearly understood and i will publish the remaining challenges later

Sign up to discover human stories that deepen your understanding of the world.

Free

Distraction-free reading. No ads.

Organize your knowledge with lists and highlights.

Tell your story. Find your audience.

Membership

Read member-only stories

Support writers you read most

Earn money for your writing

Listen to audio narrations

Read offline with the Medium app

0xBen
0xBen

Written by 0xBen

Cyber Security Engineer & Researcher | CTF Player

No responses yet

Write a response