# XSS It's used to execute malicious JavaScript in a user’s web browser or steal users' JWT tokens, CSRF tokens, and cookies. #### XSS types 1. Reflected 2. Stored 3. DOM-based ## Reflected XSS Since our input is being reflected back without XSS protections we can easily execute malicious JavaScript code in users’ browsers if they visit this link. We can test for RXSS if the GET parameter “error” is reflected in the user's web browser. For example: * an application that produces an error message when you type in the wrong username and password and the GET parameter “error” is reflected in the user's browser also

* If the application doesn’t protect against XSS we could insert malicious JS code

## Stored XSS stored XSS persistence in the application and usually occurs when an application takes user-supplied input and stores it in the backend database. Normally, it happens with POST, PUT, UPDATE, and DELETE requests as they are used when making changes to a database. For example:

* assume that the username you create is being stored in the backend database. * If you were to put a malicious JavaScript payload as your username it would then be stored in the back-end database. * If the application isn’t blocking XSS attacks whenever someone visits the members' list page, your username would be retrieved from the back-end database and your XSS payload would trigger. #### Stored XSS via SVG file Scalable Vector Graphics(SVG) is an XML-based vector image format for two-dimensional graphics with support for interactivity and animation, supports inline JS code, and also can be treated as images in HTML. EX: * an example of an SVG file with an alert message:

* So you can place an SVG file in an image tag and it will be rendered ```html Test

``` One easy way to test for this vulnerability is to upload an SVG file as your profile picture:

Once the image is uploaded, find out what path it was uploaded to by right-clicking the image and selecting “copy image address”, If everything worked when you view the image your payload will execute.

## DOM XSS Document Object Model (DOM) based XSS * occurs when an application takes user-supplied input and passes it to a JavaScript function and that uses the input to modify the DOM environment. * This can occur via reflected or stored XSS and the payload is being executed via JS.