XSS (Cross-Site Scripting)

XSS (Cross-Site Scripting)

What it is

XSS is a web bug where attackers make a site run their script in your browser. That script can read what you see, steal session cookies, change forms, or redirect you to fake pages. It shows up in a few flavors (reflected, stored, DOM-based), but the idea is the same: untrusted input becomes active code. More info: https://gridinsoft.com/xss

Why it matters

If a script runs in your session, it can act as you - grab logins, send messages, or change account settings without your click.

How it works - quick tour

  • Inject: attacker slips script into a link, comment, profile, or search box.

  • Render: the site doesn’t sanitize it and sends it to browsers.

  • Execute: your browser runs the code as if it came from the site.

  • Abuse: the script steals cookies/tokens, rewrites the page, or sends data out.

Red flags

  • A link with odd parameters like <script>, onerror=, or data that looks like code.

  • Pages that suddenly auto-fill or show pop-ups that don’t match the site’s style.

  • You click a site link and get instantly redirected through strange domains.

  • Your password manager won’t autofill on a page that looks normal.

Do it right

  • Don’t click weird tracking-looking links from DMs or comments; open the site from your bookmarks.

  • Log out and back in if a page looks tampered; clear site data for that domain.

  • Turn on a password manager and MFA - they limit damage if a session is stolen.

  • Keep your browser and extensions updated; remove extensions you don’t need.

  • If you run a site: validate/escape user input and use Content Security Policy (CSP).

    Glossary (A–Z)

    All A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

      • Related Articles

      • Web Protection

        What it is Web protection is a bundle of tools and settings that keep you safer while you browse. It blocks dangerous sites and downloads, warns about fake logins, filters sketchy links, and helps keep your info private. It can run on your device ...

      • Web Cache Poisoning

        What it is Web cache poisoning is when attackers sneak bad content into a website’s cache. The cache is a “shortcut” server use to make pages load faster for everyone. If it’s poisoned, later visitors get the attacker’s fake version instead of the ...

      • Data Execution Prevention

        What it is Data Execution Prevention (DEP) is a Windows safety net that stops code from running in places it shouldn’t—like the stack or heap. If malware tries to execute from those memory areas, Windows blocks it and shuts the app down instead of ...

      • Security Software

        What it is Security software is a set of apps and services that protect your devices and data from hackers, malware, and mistakes. It covers tools like antivirus/anti-malware, firewalls, VPNs, email and web filters, intrusion detection/prevention, ...

      • Data Breach Prevention

        Why it matters Breaches drain money, trust, and time. Strong basics turn scary “what ifs” into non-events: a phish gets ignored, a stolen password is useless, a lost laptop holds only encrypted gibberish. The short, smart checklist MFA everywhere: ...