Cross Site Scripting XSS

What does XSS and CSS mean

Cross Site Scripting is often refered to as CSS. However, CSS is already well introduced as an abrevation for Cascading Style Sheets (CSS). So security people prefere to refer to Cross Site Scripting as XSS. If you read or hear of a 'XSS security vulnerability', it is Cross Site Scripting for certain.

What is Cross Site Scripting

Todays web applications deliver dynamic content to Internet clients. The ability to individually present content and respond to client requests is standard functionality for any successful site. Unfortunately, poorly developed web applications allow an attacker to inject his own code into the HTML content. Many successfull sites are vulnerable to attacks that focus upon the way HTML content is generated and interpreted by client browsers. If an attacker is able to embed HTML-based content within client web requests he can exploit this flaws by embedding scripting elements within the returned content without the knowledge of the sites visitor.

Cross Site Scripting XSS

• The Cross Site Scripting FAQ »
  by CGISecurity
• Cross Site Scripting - Exposed »
  by Rafel Ivgi
• HTML Code Injection and Cross-site scripting »
  by Gunter Ollmann
• Real World XSS »
  by David Zimmer