Contents
What are the different types of XSS?
Types of XSS: Stored XSS, Reflected XSS and DOM-based XSS
- Stored XSS (Persistent XSS) The most damaging type of XSS is Stored XSS (Persistent XSS).
- Reflected XSS (Non-persistent XSS)
- DOM-based XSS.
- XSS Discovery and Prevention.
- Frequently asked questions.
What can XSS be used for?
An attacker can use XSS to send a malicious script to an unsuspecting user. The end user’s browser has no way to know that the script should not be trusted, and will execute the script. For more details on the different types of XSS flaws, see: Types of Cross-Site Scripting.
Why is DOM used?
The Document Object Model (DOM) is a programming interface for web documents. It represents the page so that programs can change the document structure, style, and content. The DOM represents the document as nodes and objects; that way, programming languages can interact with the page.
How does a DOM based XSS attack work?
DOM Based XSS (or as it is called in some texts, “type-0 XSS”) is an XSS attack wherein the attack payload is executed as a result of modifying the DOM “environment” in the victim’s browser used by the original client side script, so that the client side code runs in an “unexpected” manner.
What are the different types of XSS vulnerabilities?
This article describes the many different types or categories of cross-site scripting (XSS) vulnerabilities and how they relate to each other. Early on, two primary types of XSS were identified, Stored XSS and Reflected XSS. In 2005, Amit Klein defined a third type of XSS, which Amit coined DOM Based XSS.
Are there different types of DOM based XSS?
You can have both Stored and Reflected DOM Based XSS. You can also have Stored and Reflected Non-DOM Based XSS too, but that’s confusing, so to help clarify things, starting about mid 2012, the research community proposed and started using two new terms to help organize the types of XSS that can occur:
Can you have both reflected and stored XSS?
As such, you can have both Reflected Client XSS and Stored Client XSS. With these new definitions, the definition of DOM Based XSS doesn’t change. DOM Based XSS is simply a subset of Client XSS, where the source of the data is somewhere in the DOM, rather than from the Server.