Knowledge MaxxingCross-site scripting
Cross-site scripting is an attack where malicious script gets injected into a page and runs in another user's browser, often because untrusted input was displayed without proper handling.
Prerequisite: Injection attack
What matters
Because the malicious script runs with the same trust as the real page, it can steal session data or perform actions as if it were the actual logged-in user.
Example
If a comment field displays user input directly as raw HTML, an attacker could submit a comment containing a script that runs in every other visitor's browser who views it.
Common misconception
Cross-site scripting is not primarily about attacking the server; the attack specifically runs malicious code in another user's browser, targeting that person, not the server itself.
Recall question
Whose browser does a cross-site scripting attack actually run its malicious code in?