Cross Site Scripting (XSS)

  1. Attack Vectors and Injection Points
    1. Input Vector Analysis
      1. Form-Based Inputs
        1. Text Fields
          1. Hidden Fields
            1. Textarea Elements
              1. Select Options
              2. URL-Based Inputs
                1. Query Parameters
                  1. Path Components
                    1. Fragment Identifiers
                    2. HTTP Header Exploitation
                      1. User-Agent Manipulation
                        1. Referer Header Injection
                          1. Custom Header Processing
                            1. X-Forwarded-For Exploitation
                            2. File Upload Vectors
                              1. Filename Injection
                                1. Metadata Exploitation
                                  1. Content-Type Manipulation
                                  2. WebSocket Communications
                                    1. Message Content Injection
                                      1. Protocol Upgrade Exploitation
                                    2. Third-Party Integration Risks
                                      1. Widget Embedding
                                        1. Social Media Integration
                                          1. Analytics Platforms
                                            1. Content Delivery Networks

                                          Previous

                                          4. XSS Attack Classification

                                          Go to top

                                          Next

                                          6. Payload Construction and Techniques