Types of XSS

Before with go ahead about types of XSS lets have a quick look at following attacks ,which based on how they are affecting the client or server can be categorised :-

Stored XSS

Stored XSS generally occurs when user input can be stored on the target server, in database, in the form of message in comment filed, visitor log etc. And then victim retrieves the stored data from the web application without that data being made safe to render in the browser. With the advent of HTML5, and other browser technologies, we can avoid the attack payload being permanently stored in the victim’s browser, such as an HTML5 database, and hence stopping it from reaching the server at all.

Reflected XSS

Reflected XSS occurs when user input is immediately returned by a web application in the form of a error message, search result, or any other response that includes some or all of the input provided by the user as part of the request, without that data being made safe to render in the browser, and without permanently storing the user provided data.

DOM Based XSS

Before starting what DOM Based XSS is lets know actually what DOM is ?

DOM stands for Document Object Model and is used for representing and working with objects in an HTML document. DOM consists of objects representing the document properties from the point of view of the browser. Whenever a script is executed client-side, the browser provides the code with the DOM of the HTML page where the script runs, thus, offering access to various properties of the page and their values, populated by the browser from its perspective.

DOM XSS is a type of XSS which relies on inappropriate handling, in the HTML page, of the data from its associated DOM. Among the objects in the DOM, there are several entities which the attacker can manipulate in order to generate the XSS condition, and the most exploited , from this perspective, are the document.url, document.location and document.referrer objects.

In the next Blog post we will see an example of the above .till then 

Happy Learning :)