Cross-Site Scripting (XSS) Explained for Beginners

Cross-site scripting, or XSS, lets an attacker run their own script in another user's browser, inside a trusted website. It is one of the most commonly reported web vulnerabilities in bug bounty programs. This guide explains the three types, why they matter and how they are fixed.

The Idea

A website shows text that came from a user: a search term, a comment, a profile name. If it inserts that text into the page without treating it as plain text, a browser may run it as code. Because the script runs on the real website, it can do anything that site's pages can do for the logged-in victim.

The Three Types

• Reflected XSS: the input comes from the request, for example a search parameter in a link, and is shown straight back. The attacker must get the victim to open a crafted link.
• Stored XSS: the input is saved, for example in a comment, and shown to everyone who views it. More dangerous, because it needs no special link.
• DOM-based XSS: the flaw is in the page's own JavaScript, which takes data from the URL or elsewhere and writes it into the page unsafely.

What an Attacker Can Do

• Act as the victim: change settings, send messages, make purchases
• Read data shown to the victim on that site
• Steal session tokens that are readable by scripts
• Show a fake login form on the real domain

How Testers Find It

Testers find every place user input appears in a page, work out the context (inside HTML, an attribute, JavaScript or a URL), and test whether characters that break out of that context survive. Burp Suite helps track where input is reflected. Proof of concept is kept harmless, such as showing an alert box, and only on authorized targets or labs like PortSwigger's Web Security Academy.

How Developers Prevent It

• Encode output for its context: HTML, attribute, JavaScript and URL contexts each need the right encoding
• Use frameworks that escape output by default, and avoid functions that bypass it
• Sanitize any user-supplied HTML with a maintained library
• Add a Content Security Policy to limit which scripts can run
• Mark session cookies HttpOnly so scripts cannot read them

Where It Sits in OWASP

XSS is part of the Injection category in the OWASP Top 10:2025, alongside SQL injection.

Learning Web Testing

Our Application Security course covers XSS and the other OWASP risks with Burp Suite in authorized labs, from finding a flaw to reporting it and checking the fix.