XSS
Technology & Computing abbreviation · Cybersecurity
| Stands for | Cross-site scripting |
|---|---|
| Categories | Technology & Computing |
XSS stands for Cross-site scripting, a cybersecurity abbreviation.
A web vulnerability in which an attacker gets a site to include malicious JavaScript in pages viewed by other users, letting the script steal session cookies, capture keystrokes or act as the victim. It arises when user input is placed into pages without proper escaping.
Example: The comment field allowed stored XSS, so anyone viewing the post ran the attacker's script.
Usage notes
Main types are stored, reflected and DOM-based XSS. The abbreviation uses X instead of C to avoid confusion with Cascading Style Sheets. Defenses include output encoding, frameworks that escape by default, Content Security Policy and HttpOnly cookies. The 2005 Samy worm spread to over a million MySpace profiles in about a day through XSS.
Related abbreviations
More cybersecurity abbreviations
- 2FA – Two-factor authentication
- AAA – Authentication, authorization and accounting
- ABAC – Attribute-based access control
- ACL – Access control list
- AES – Advanced Encryption Standard
- APT – Advanced persistent threat
- ASLR – Address space layout randomization
- ATT&CK – Adversarial Tactics, Techniques, and Common Knowledge
- AV – Antivirus
- BEC – Business email compromise
- BYOD – Bring your own device
- C2 – Command and control