SPACEIO // CYBERSECURITY Vulnerability of the Day

XSS: when a website runs the attacker's code in your browser

You trusted the site. The site trusted the input. That's the problem.

How it works

If a site shows user input on a page without cleaning it, an attacker can slip in a script. When another user opens the page, the script runs in their browser, with their session.

Why it matters

XSS can steal session data, change what a page shows, or send users to fake pages. It is one of the most commonly reported web bugs.

How to fix it

Encode output, validate input, use a Content-Security-Policy and mark session cookies HttpOnly.

Try it

Practise it only in a legal lab. Share what you found in the community.