Cross-site scripting (XSS): The hidden threat on the Internet

Cyber criminals are getting very creative when it comes to how they can harm their potential victims. From spam text messages and phishing emails to malicious downloads, hackers and the like can use any means at their disposal. Another, comparatively less complex threat is cross-site scripting. Find out in this article what this means, how it works and how you can protect yourself. You can also find out how Avira Browser Safety can help you to navigate the Internet more safely.

What is cross-site scripting (XSS)?

The term cross-site scripting (XSS for short) refers to a method of attack on the internet in which cyber criminals exploit security vulnerabilities on websites. In an XSS attack, attackers inject malicious code into the affected website. The special feature here is that the code is not executed on the server of the visited website, but in the visitor’s browser. This code snippet is often injected via the comment or search field. It becomes dangerous as soon as the browser reads and executes it.

The JavaScript programming language plays a decisive role here. Developers use it to integrate interactive elements into websites. Through security gaps in the scripts, such as comment fields, search bars and login forms, cyber criminals inject their code into the affected website. This turns an actually harmless website into a malicious address for internet users. As input fields are primarily manipulated, cross-site scripting is essentially comparable to an SQL injection.

How does cross-site scripting work?

Basically, cross-site scripting always works by exploiting security vulnerabilities on a website. The attacker identifies this vulnerability and injects his code (usually via JavaScript). As soon as the user accesses the website in their browser, the malicious code is activated.

There are three different types of cross-site scripting, all of which work differently.

Stored XSS

With stored XSS, also known as persistent XSS, criminals inject the code not just temporarily but permanently onto the server of the affected website. In most cases, it is injected into a database and executed every time a browser executes the section of the website.

Example: A cybercriminal leaves a comment, forum post or guestbook entry. He places the malicious code in this text. As soon as the potential victim reads this text field with the browser, the code is executed unnoticed in the background.

Reflected XSS

Another type of cross-site scripting is so-called reflected XSS. Here, it is not the website or an input field that is manipulated, but the link that leads to the website. When the user clicks on the link, the website opens and the code is also sent to the server as part of the URL. The server sends the code directly back to the browser (the code is ‘reflected’) so that the browser executes it.

Example: A cybercriminal sends his potential victim a link to a website. The URL of the link is already supplemented with the malicious code so that it is executed directly when it is opened in the browser.

DOM-based XSS

In local or DOM-based XSS attacks, cyber criminals do not exploit a vulnerability on a web server, but send the malicious script to potential victims via email. This malicious script is then executed in the browser without you noticing. The perpetrators use social engineering methods (such as phishing or spoofing) to trick unsuspecting victims into accessing a fraudulent website.

All you have to do is click on a supposedly trustworthy link sent to you by email and your browser will integrate the malicious script (this is called ‘client-side JavaScript’). It accepts this infected script because it is mistakenly regarded as part of the source code of this supposedly trustworthy website and executes it – in other words, it shows you the website you have called up, albeit a manipulated one. If your browser also has special rights on your laptop or PC, hackers can then even spy on and manipulate locally stored data on your device.

Example: A user opens a page via the malicious link. The browser loads the website and the associated HTML code. The Document Object Model (DOM) describes the structure of precisely this HTML code and gives JavaScript the ability to change certain elements of the page. Cyber criminals change and manipulate these elements by inserting malicious code. This code is then retrieved when the user visits the page, downloaded by the browser and executed.

What are the effects of XSS attacks?

Cross-site scripting attacks can have different effects. In any case, XSS represents an attack on the security of web applications and the users who use these web applications.

The most common consequences of cross-site scripting include:

• Data theft: Login data can be stolen as soon as it is entered, allowing criminals to gain access to user accounts.
• Session hijacking: Cybercriminals can access sensitive and personal data through the targeted theft of session cookies. By taking over the cookies, the perpetrators do not have to log in themselves, as the victims are already logged in to their session.
• Phishing attacks: Using fake or manipulated input forms, victims enter sensitive data which is then sent directly to the perpetrators.
• Website manipulation: The malicious code manipulates the appearance, behaviour and content of websites. This spreads false messages and malicious links and damages the reputation of the website.
• Malware: Cybercriminals spread malicious scripts, spyware and malware that are automatically downloaded when the user visits the site. As a result, data is stolen, computers are slowed down or completely paralysed.
• Unauthorised privilege escalation: An attacker gains increased rights in a web application, giving them more control over said application or the potential victim’s system.

How do you recognise cross-site scripting?

As most XSS attacks run unnoticed in the background, it is comparatively difficult for you as an Internet user to notice them. However, there are a few points that you should take into account and be aware of when surfing:

• URL structure: Do you receive a link that has an unusually long or complex URL parameter? If it also contains HTML-like code, you should exercise extreme caution. Caution: URLs can be disguised by spoofing Always copy links to the clipboard beforehand and paste them into the text editor, for example, in order to recognise the exact target.
• Website behaviour: You should be sceptical about unexpected pop-ups, redirects or design elements on familiar websites.
• Browser warnings: Modern internet browsers have integrated protection tools against XSS. Always keep your browser up to date so that it displays appropriate warnings or blocks suspicious content directly.
• Pre-filled forms: If strange content is already stored in the search or comment field, this may already be an attempt at an XSS attack.

How can you protect yourself against cross-site scripting?

First of all: Website operators should ensure that all user input is filtered and cleaned to prevent malicious code from being passed on, for example via links. A content security policy (CSP) can also help by specifying which content may be loaded and executed on a website.

But as a website visitor, you can also help to protect yourself from XSS attacks. After all, the user remains the biggest vulnerability when using digital devices and applications.

• Update your browser: You should update your internet browser at regular intervals to close potential security loopholes and always have the latest security features.
• Read emails carefully: If you receive an email without a personalised address and with numerous spelling mistakes, you should be sceptical. Always check the sender and never carelessly click on links in emails that you were not expecting.
• Check links: You should not click on unknown and suspicious links lightly. Before clicking, move the mouse pointer over the link to see the complete URL in the browser or mail programme.
• Password manager: Many security vulnerabilities are hidden in input fields. A password manager only fills in legitimate websites automatically. So if the tool does not automatically store your data, this may indicate a potential danger.
• Avoid insecure sites: If possible, you should only visit websites that rely on the HTTPS protocol. All communication on these sites is encrypted, making it more difficult to manipulate data traffic. This is particularly important when it comes to sensitive data (e.g. online banking, shopping, etc.).
• Block scripts: You can also use a plugin that blocks the execution of JavaScript on unknown or insecure pages. However, it is then possible that the pages cannot be displayed and used as intended.
• Delete cookies: It is advisable to delete cookies regularly. Always log out of websites with sensitive user data as soon as you no longer need access. This will prevent attackers from accessing the sessions.

You should also inform the website operator of any unusual activity. If you notice dodgy pop-ups or receive a manipulated link, your knowledge can protect other potential victims.

Safer on the Internet – with Avira Browser Safety

You now know what to look out for when using cross-site scripting. If you want to be even safer on the Internet, Avira Browser Safety will help you. The free plugin protects your browser from malicious websites, blocks infected adverts and prevents tracking by third parties.

It also detects and removes unwanted applications that have attached themselves to your downloads. With Avira Browser Safety, you are on the safe side and give cyber criminals less and less of a target.