A3:2021 | Cross Site Scripting Stored (2)

Stored XSS

Stored Cross-Site Scripting is different in that the payload is persisted (stored) instead of passed/injected via a link.

Stored XSS Scenario

• Attacker posts malicious script to a message board.

• Message is stored in a server database.

• Victim reads the message.

• The malicious script embedded in the message board post executes in the victim’s browser.

  • The script steals sensitive information, like the session id, and releases it to the attacker.

Victim does not realize attack occurred