Exploiting one of these, attackers fold malicious content into the content being delivered from the compromised site.
When the resulting combined content arrives at the client-side web browser, it has all been delivered from the trusted source, and thus operates under the permissions granted to that system.
The expression "cross-site scripting" originally referred to the act of loading the attacked, third-party web application from an unrelated attack-site, in a manner that executes a fragment of Java Script prepared by the attacker in the security context of the targeted domain (taking advantage of a reflected or non-persistent XSS vulnerability).
The definition gradually expanded to encompass other modes of code injection, including persistent and non-Java Script vectors (including Active X, Java, VBScript, Flash, or even HTML scripts), causing some confusion to newcomers to the field of information security.
There is no single, standardized classification of cross-site scripting flaws, but most experts distinguish between at least two primary flavors of XSS flaws: non-persistent and persistent.
Some sources further divide these two groups into traditional (caused by server-side code flaws) and DOM-based (in client-side code).
These holes show up when the data provided by a web client, most commonly in HTTP query parameters (e.g.
HTML form submission), is used immediately by server-side scripts to parse and display a page of results for and to that user, without properly sanitizing the request.
Because HTML documents have a flat, serial structure that mixes control statements, formatting, and the actual content, any non-validated user-supplied data included in the resulting page without proper HTML encoding, may lead to markup injection.
A classic example of a potential vector is a site search engine: if one searches for a string, the search string will typically be redisplayed verbatim on the result page to indicate what was searched for.
Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications.