Top 10 2010-A2-Cross-Site Scripting (XSS)

The application uses untrusted data in the construction of the following HTML snippet without validation or escaping:
 * [[File:Xss-snippet-1.png]]

The attacker modifies the ‘CC’ parameter in their browser to:
 * [[File:Xss-snippet-2.png]]

This causes the victim’s session ID to be sent to the attacker’s website, allowing the attacker to hijack the user’s current session.

Note that attackers can also use XSS to defeat any automated CSRF defense the application might employ. See A5 for info on CSRF.


 * OWASP XSS Prevention Cheat Sheet
 * OWASP Cross-Site Scripting Article
 * ESAPI Project Home Page
 * ESAPI Encoder API
 * ASVS: Output Encoding/Escaping Requirements (V6)
 * ASVS: Input Validation Requirements (V5)
 * Testing Guide: 1st 3 Chapters on Data Validation Testing
 * OWASP Code Review Guide: Chapter on XSS Review


 * CWE Entry 79 on Cross-Site Scripting
 * RSnake's XSS Attack Cheat Sheet