Reflected Cross Site Scripting

Abstract

Cross-Site Scripting, also called as XSS, is a type of injection where malicious scripts are injected into trusted websites. When malicious code, usually in the form of browser side script, is injected using a web application to a different end user, an XSS attack is said to have taken place. Flaws which allow success to this attack are remarkably widespread and occur anywhere a web application handles the user input without validating or encoding it. A study carried out by Symantec states that more than 50% of the websites are vulnerable to the XSS attack. Security engineers of Microsoft coined the term “Cross-Site Scripting” in January of the year 2000. But even if it was coined in the year 2000, XSS vulnerabilities have been reported and exploited since the beginning of 1990’s, whose prey have been all the (then) tech-giants such as Twitter, Myspace, Orkut, Facebook and YouTube. Hence the name “Cross-Site” Scripting. This attack could be combined with other attacks such as phishing attack to make it more lethal but it usually isn’t necessary, since it is already extremely difficult to deal with from a user perspective because in many cases it looks very legitimate as it’s leveraging attacks against our banks, our shopping websites and not some fake malicious website.