XSS stands for cross-site scripting and is a Web-based security vulnerability that has existed since the birth of modern Web development techniques.
XSS attacks represent 12.75% of all Web-based attacks today and nearly 70% of all reported XSS-related vulnerabilities. Nearly 90% of all websites have at least one XSS vulnerability.
In addition to DDOS attacks and SQL injections, XSS attacks are the third form of Web attack that we may encounter.
In the past, major sites such as Twitter, Facebook, YouTube, Yahoo, MySpace or PayPal have all been victims of such attacks.
Yahoo was plagued by this problem so much that at some point, its engineers open-sourced a series of XSS filtersso that other webmasters could benefit from their work.
Recently, even desktop-based software like Popcorn Time has become vulnerable to these kinds of issues. This is because Popcorn Time was built using Node.js, a complex platform for server-side JavaScript, instead of classic tools like C++ or C#.
XSS attacks can be of two types: Reflected and Stored.
A Reflected XSS attack occurs when hackers craft malicious URLs that Web servers execute through a single request and response loop. It is the most common attack and is short-lived, affecting one user at a time. It is also known as first-order XSS, type 1 XSS, or non-persistent XSS.
A Stored XSS attack is the worst-case scenario of the two and involves the attacker crafting a malicious script, which is then stored on the Web server. This type of XSS attack has a broader scope, since, once stored on the server in the form of a comment or database entry, it can then be displayed to all users accessing that page without having to access a maliciously crafted URL. This type of attack is also called second-order XSS, type 2 XSS, or persistent XSS.
In case you need a visual aid for all of this, the infographic below might help you get an idea of what we’re talking about. It was created by Jack Leonard from Barricade, an Irish company that focuses on security products for small and medium-sized businesses:
