{"id":89968,"date":"2017-07-17T05:59:57","date_gmt":"2017-07-17T05:59:57","guid":{"rendered":"https:\/\/webkul.com\/blog\/?p=89968"},"modified":"2017-07-26T07:49:08","modified_gmt":"2017-07-26T07:49:08","slug":"cross-site-scripting","status":"publish","type":"post","link":"https:\/\/webkul.com\/blog\/cross-site-scripting\/","title":{"rendered":"What is Cross-Site Scripting?"},"content":{"rendered":"

In this blog, we will learn about cross-site scripting. Let’s start with what is cross-site scripting.<\/p>\n

\n
\n

What is Cross-Site Scripting?<\/h3>\n<\/div>\n
\n

Cross-Site Scripting<\/strong> or XSS<\/strong> allows an attacker to destroy your existing project, or take advantage of it. XSS injection can be possible when there is a scope for the attacker to insert unauthorized JavaScript, VBScript, HTML, or other active content into a web page. It could provide the attacker any confidential data, which might cause loss of valuable information.<\/p>\n<\/div>\n<\/div>\n

\n
\n

What are the Types of XSS Attacks<\/h3>\n<\/div>\n
\n

There are following types of XSS attacks:<\/p>\n

Stored XSS :<\/strong> If we provide a platform to an end user, through which we can save information provided by them to the database. It gives the attacker an aperture to cause harm to our system and sneak some valuable information, making us vulnerable.<\/p>\n

Reflected XSS :<\/strong> The malicious information sent through URL parameter, are reflected XSS.<\/p>\n

DOM-based XSS :<\/strong> It refer to making changes in DOM at the client side. The server side web page does not change but executes in the way that is not intended.<\/p>\n<\/div>\n<\/div>\n

\n
\n

Impact of XSS<\/h3>\n<\/div>\n
\n

There are following impacts of XSS:<\/p>\n

1) Arbitrary Requests :<\/strong> The hacker can use XSS to send request to get information from the user end.
\n2) Malware Download :<\/strong> Sometimes we get some spam mail, through which malware could be downloaded.
\n3) Log keystrokes :<\/strong> The attacker could identify key-strokes to get username and password to log in future.<\/p>\n<\/div>\n<\/div>\n

\n
\n

Example<\/h3>\n<\/div>\n
\n

Let us visualize the concept of XSS in Salesforce through an example. Create a new visualforce page and write the following code:<\/p>\n

<apex:page >\r\n    <!-- XSSDemo -->\r\n    <!-- \r\n        \/**\r\n         * Webkul Software.\r\n         *\r\n         * @category  Webkul\r\n         * @author    Webkul\r\n         * @copyright Copyright (c) 2010-2016 Webkul Software Private Limited (https:\/\/webkul.com)\r\n         * @license   https:\/\/store.webkul.com\/license.html\r\n         *\/\r\n     -->\r\n  <div id='container'><\/div>\r\n    <script>\r\n      document.querySelector('#container').innerHTML='You searched for <b>{!$CurrentPage.parameters.param}<\/b>';\r\n    <\/script>\r\n<\/apex:page><\/pre>\n
As you can notice current page parameter “param” is reflected in the page. Let us pass a string parameter ex-‘account’ through the url as following:<\/p>\n
\/apex\/XSSDemo?param=account<\/pre>\n
We will get desired output:
\n\"\"<\/a><\/p>\n
Now let us pass an incorrect parameter as following:<\/p>\n
\/apex\/XSSDemo?param=<script>alert(%27Hi!%27)<\/script><\/pre>\n
We will get the distorted output:
\n\"\"<\/a><\/p>\n
Example shared above is concerned with Reflected XSS.<\/strong> <\/p>\n<\/div>\n<\/div>\n
\n
\n
<\/i>Support<\/h3>\n<\/div>\n
\n
That\u2019s all for cross-site scripting, still, if you have any issue feel free to add a ticket and let us know your views to make it better  https:\/\/webkul.uvdesk.com\/en\/customer\/create-ticket\/<\/a><\/p>\n<\/div>\n<\/div>\n
 <\/p>\n","protected":false},"excerpt":{"rendered":"
In this blog, we will learn about cross-site scripting. Let’s start with what is cross-site scripting. What is Cross-Site Scripting? Cross-Site Scripting or XSS allows an attacker to destroy your existing project, or take advantage of it. XSS injection can be possible when there is a scope for the attacker to insert unauthorized JavaScript, VBScript, […]<\/a><\/p>\n","protected":false},"author":104,"featured_media":90058,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1887],"tags":[5074],"class_list":["post-89968","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-salesforce","tag-cross-site-scripting"],"yoast_head":"\nCross-Site Scripting<\/title>\n<meta name=\"description\" content=\"In this blog, we will be learning about cross-site scripting. Let's get started with what is cross-site scripting or XSS.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/webkul.com\/blog\/cross-site-scripting\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Cross-Site Scripting\" \/>\n<meta property=\"og:description\" content=\"In this blog, we will be learning about cross-site scripting. Let's get started with what is cross-site scripting or XSS.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/webkul.com\/blog\/cross-site-scripting\/\" \/>\n<meta property=\"og:site_name\" content=\"Webkul Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/webkul\/\" \/>\n<meta property=\"article:published_time\" content=\"2017-07-17T05:59:57+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2017-07-26T07:49:08+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cdnblog.webkul.com\/blog\/wp-content\/uploads\/2017\/07\/crosswebkul.png\" \/>\n\t<meta property=\"og:image:width\" content=\"825\" \/>\n\t<meta property=\"og:image:height\" content=\"260\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Aakanksha Singh\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@webkul\" \/>\n<meta name=\"twitter:site\" content=\"@webkul\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Aakanksha Singh\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/webkul.com\/blog\/cross-site-scripting\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/webkul.com\/blog\/cross-site-scripting\/\"},\"author\":{\"name\":\"Aakanksha Singh\",\"@id\":\"https:\/\/webkul.com\/blog\/#\/schema\/person\/7d54984c6524404eb2ba261ace62da80\"},\"headline\":\"What is Cross-Site Scripting?\",\"datePublished\":\"2017-07-17T05:59:57+00:00\",\"dateModified\":\"2017-07-26T07:49:08+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/webkul.com\/blog\/cross-site-scripting\/\"},\"wordCount\":351,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/webkul.com\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/webkul.com\/blog\/cross-site-scripting\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cdnblog.webkul.com\/blog\/wp-content\/uploads\/2017\/07\/crosswebkul.png\",\"keywords\":[\"cross-site scripting\"],\"articleSection\":[\"Salesforce\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/webkul.com\/blog\/cross-site-scripting\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/webkul.com\/blog\/cross-site-scripting\/\",\"url\":\"https:\/\/webkul.com\/blog\/cross-site-scripting\/\",\"name\":\"Cross-Site Scripting\",\"isPartOf\":{\"@id\":\"https:\/\/webkul.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/webkul.com\/blog\/cross-site-scripting\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/webkul.com\/blog\/cross-site-scripting\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cdnblog.webkul.com\/blog\/wp-content\/uploads\/2017\/07\/crosswebkul.png\",\"datePublished\":\"2017-07-17T05:59:57+00:00\",\"dateModified\":\"2017-07-26T07:49:08+00:00\",\"description\":\"In this blog, we will be learning about cross-site scripting. Let's get started with what is cross-site scripting or XSS.\",\"breadcrumb\":{\"@id\":\"https:\/\/webkul.com\/blog\/cross-site-scripting\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/webkul.com\/blog\/cross-site-scripting\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/webkul.com\/blog\/cross-site-scripting\/#primaryimage\",\"url\":\"https:\/\/cdnblog.webkul.com\/blog\/wp-content\/uploads\/2017\/07\/crosswebkul.png\",\"contentUrl\":\"https:\/\/cdnblog.webkul.com\/blog\/wp-content\/uploads\/2017\/07\/crosswebkul.png\",\"width\":825,\"height\":260},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/webkul.com\/blog\/cross-site-scripting\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/webkul.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"What is Cross-Site Scripting?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/webkul.com\/blog\/#website\",\"url\":\"https:\/\/webkul.com\/blog\/\",\"name\":\"Webkul Blog\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/webkul.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/webkul.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/webkul.com\/blog\/#organization\",\"name\":\"WebKul Software Private Limited\",\"url\":\"https:\/\/webkul.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/webkul.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/cdnblog.webkul.com\/blog\/wp-content\/uploads\/2021\/08\/webkul-logo-accent-sq.png\",\"contentUrl\":\"https:\/\/cdnblog.webkul.com\/blog\/wp-content\/uploads\/2021\/08\/webkul-logo-accent-sq.png\",\"width\":380,\"height\":380,\"caption\":\"WebKul Software Private Limited\"},\"image\":{\"@id\":\"https:\/\/webkul.com\/blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/webkul\/\",\"https:\/\/x.com\/webkul\",\"https:\/\/www.instagram.com\/webkul\/\",\"https:\/\/www.linkedin.com\/company\/webkul\",\"https:\/\/www.youtube.com\/user\/webkul\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/webkul.com\/blog\/#\/schema\/person\/7d54984c6524404eb2ba261ace62da80\",\"name\":\"Aakanksha Singh\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/webkul.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/eef6d7ed23fc4ad8f12c94d6d6d30ec2ebbb9bedbf9d8a9dc8626a3a171fa3fa?s=96&d=https%3A%2F%2Fcdnblog.webkul.com%2Fblog%2Fwp-content%2Fuploads%2F2019%2F10%2Feva.png&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/eef6d7ed23fc4ad8f12c94d6d6d30ec2ebbb9bedbf9d8a9dc8626a3a171fa3fa?s=96&d=https%3A%2F%2Fcdnblog.webkul.com%2Fblog%2Fwp-content%2Fuploads%2F2019%2F10%2Feva.png&r=g\",\"caption\":\"Aakanksha Singh\"},\"url\":\"https:\/\/webkul.com\/blog\/author\/aakanksha-singh391\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Cross-Site Scripting","description":"In this blog, we will be learning about cross-site scripting. Let's get started with what is cross-site scripting or XSS.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/webkul.com\/blog\/cross-site-scripting\/","og_locale":"en_US","og_type":"article","og_title":"Cross-Site Scripting","og_description":"In this blog, we will be learning about cross-site scripting. Let's get started with what is cross-site scripting or XSS.","og_url":"https:\/\/webkul.com\/blog\/cross-site-scripting\/","og_site_name":"Webkul Blog","article_publisher":"https:\/\/www.facebook.com\/webkul\/","article_published_time":"2017-07-17T05:59:57+00:00","article_modified_time":"2017-07-26T07:49:08+00:00","og_image":[{"width":825,"height":260,"url":"https:\/\/cdnblog.webkul.com\/blog\/wp-content\/uploads\/2017\/07\/crosswebkul.png","type":"image\/png"}],"author":"Aakanksha Singh","twitter_card":"summary_large_image","twitter_creator":"@webkul","twitter_site":"@webkul","twitter_misc":{"Written by":"Aakanksha Singh","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/webkul.com\/blog\/cross-site-scripting\/#article","isPartOf":{"@id":"https:\/\/webkul.com\/blog\/cross-site-scripting\/"},"author":{"name":"Aakanksha Singh","@id":"https:\/\/webkul.com\/blog\/#\/schema\/person\/7d54984c6524404eb2ba261ace62da80"},"headline":"What is Cross-Site Scripting?","datePublished":"2017-07-17T05:59:57+00:00","dateModified":"2017-07-26T07:49:08+00:00","mainEntityOfPage":{"@id":"https:\/\/webkul.com\/blog\/cross-site-scripting\/"},"wordCount":351,"commentCount":0,"publisher":{"@id":"https:\/\/webkul.com\/blog\/#organization"},"image":{"@id":"https:\/\/webkul.com\/blog\/cross-site-scripting\/#primaryimage"},"thumbnailUrl":"https:\/\/cdnblog.webkul.com\/blog\/wp-content\/uploads\/2017\/07\/crosswebkul.png","keywords":["cross-site scripting"],"articleSection":["Salesforce"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/webkul.com\/blog\/cross-site-scripting\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/webkul.com\/blog\/cross-site-scripting\/","url":"https:\/\/webkul.com\/blog\/cross-site-scripting\/","name":"Cross-Site Scripting","isPartOf":{"@id":"https:\/\/webkul.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/webkul.com\/blog\/cross-site-scripting\/#primaryimage"},"image":{"@id":"https:\/\/webkul.com\/blog\/cross-site-scripting\/#primaryimage"},"thumbnailUrl":"https:\/\/cdnblog.webkul.com\/blog\/wp-content\/uploads\/2017\/07\/crosswebkul.png","datePublished":"2017-07-17T05:59:57+00:00","dateModified":"2017-07-26T07:49:08+00:00","description":"In this blog, we will be learning about cross-site scripting. Let's get started with what is cross-site scripting or XSS.","breadcrumb":{"@id":"https:\/\/webkul.com\/blog\/cross-site-scripting\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/webkul.com\/blog\/cross-site-scripting\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/webkul.com\/blog\/cross-site-scripting\/#primaryimage","url":"https:\/\/cdnblog.webkul.com\/blog\/wp-content\/uploads\/2017\/07\/crosswebkul.png","contentUrl":"https:\/\/cdnblog.webkul.com\/blog\/wp-content\/uploads\/2017\/07\/crosswebkul.png","width":825,"height":260},{"@type":"BreadcrumbList","@id":"https:\/\/webkul.com\/blog\/cross-site-scripting\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/webkul.com\/blog\/"},{"@type":"ListItem","position":2,"name":"What is Cross-Site Scripting?"}]},{"@type":"WebSite","@id":"https:\/\/webkul.com\/blog\/#website","url":"https:\/\/webkul.com\/blog\/","name":"Webkul Blog","description":"","publisher":{"@id":"https:\/\/webkul.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/webkul.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/webkul.com\/blog\/#organization","name":"WebKul Software Private Limited","url":"https:\/\/webkul.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/webkul.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/cdnblog.webkul.com\/blog\/wp-content\/uploads\/2021\/08\/webkul-logo-accent-sq.png","contentUrl":"https:\/\/cdnblog.webkul.com\/blog\/wp-content\/uploads\/2021\/08\/webkul-logo-accent-sq.png","width":380,"height":380,"caption":"WebKul Software Private Limited"},"image":{"@id":"https:\/\/webkul.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/webkul\/","https:\/\/x.com\/webkul","https:\/\/www.instagram.com\/webkul\/","https:\/\/www.linkedin.com\/company\/webkul","https:\/\/www.youtube.com\/user\/webkul\/"]},{"@type":"Person","@id":"https:\/\/webkul.com\/blog\/#\/schema\/person\/7d54984c6524404eb2ba261ace62da80","name":"Aakanksha Singh","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/webkul.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/eef6d7ed23fc4ad8f12c94d6d6d30ec2ebbb9bedbf9d8a9dc8626a3a171fa3fa?s=96&d=https%3A%2F%2Fcdnblog.webkul.com%2Fblog%2Fwp-content%2Fuploads%2F2019%2F10%2Feva.png&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/eef6d7ed23fc4ad8f12c94d6d6d30ec2ebbb9bedbf9d8a9dc8626a3a171fa3fa?s=96&d=https%3A%2F%2Fcdnblog.webkul.com%2Fblog%2Fwp-content%2Fuploads%2F2019%2F10%2Feva.png&r=g","caption":"Aakanksha Singh"},"url":"https:\/\/webkul.com\/blog\/author\/aakanksha-singh391\/"}]}},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/webkul.com\/blog\/wp-json\/wp\/v2\/posts\/89968","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/webkul.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/webkul.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/webkul.com\/blog\/wp-json\/wp\/v2\/users\/104"}],"replies":[{"embeddable":true,"href":"https:\/\/webkul.com\/blog\/wp-json\/wp\/v2\/comments?post=89968"}],"version-history":[{"count":7,"href":"https:\/\/webkul.com\/blog\/wp-json\/wp\/v2\/posts\/89968\/revisions"}],"predecessor-version":[{"id":91152,"href":"https:\/\/webkul.com\/blog\/wp-json\/wp\/v2\/posts\/89968\/revisions\/91152"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/webkul.com\/blog\/wp-json\/wp\/v2\/media\/90058"}],"wp:attachment":[{"href":"https:\/\/webkul.com\/blog\/wp-json\/wp\/v2\/media?parent=89968"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/webkul.com\/blog\/wp-json\/wp\/v2\/categories?post=89968"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/webkul.com\/blog\/wp-json\/wp\/v2\/tags?post=89968"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}