Dev adventures, epic bugs, tiny wins, and the occasional meltdown. Zola 2026-06-28T00:00:00+00:00 https://golden-fox.dev/tags/xss/atom.xml 2026-06-28T00:00:00+00:00 2026-06-28T00:00:00+00:00 Aakriti Agarwal https://golden-fox.dev/til/xss/ <p>So today I came across Cross Site Scripting or XSS which honestly sounds like a Counter Strike mode but is actually one of the oldest and most annoying vulnerabilities on the web. Once I understood it, I felt a little unsafe about every comment section I’ve ever used lol.</p> <h2 id="what-is-it-actually">What is it actually</h2> <p>XSS is when a website lets someone sneak their own javascript into a page, and your browser just… runs it. no questions asked, zero trust issues, straight up “sure i’ll run that.” The browser assumes any JavaScript that’s part of the page came from the website itself, so if the site accidentally treats user input as code instead of text, it’ll execute it. It’s not movie hacker stuff, it’s just a website not checking what a user typed before showing it to everyone else.</p> <h2 id="example-that-made-it-click">Example that made it click</h2> <p>if a site does this to show your comment:</p> <pre class="giallo" style="color-scheme: light dark; color: light-dark(#657B83, #839496); background-color: light-dark(#FDF6E3, #002B36);"><code data-lang="javascript"><span class="giallo-l"><span style="color: light-dark(#268BD2, #268BD2);">element</span><span>.</span><span style="color: light-dark(#268BD2, #268BD2);">innerHTML</span><span style="color: light-dark(#859900, #859900);"> =</span><span style="color: light-dark(#268BD2, #268BD2);"> userComment</span><span>;</span></span></code></pre> <p>and someone comments:</p> <pre class="giallo" style="color-scheme: light dark; color: light-dark(#657B83, #839496); background-color: light-dark(#FDF6E3, #002B36);"><code data-lang="html"><span class="giallo-l"><span style="color: light-dark(#93A1A1, #586E75);">&lt;</span><span style="color: light-dark(#268BD2, #268BD2);">script</span><span style="color: light-dark(#93A1A1, #586E75);">&gt;</span><span style="color: light-dark(#268BD2, #268BD2);">alert</span><span>(</span><span style="color: light-dark(#2AA198, #2AA198);">&#39;</span><span style="color: light-dark(#2AA198, #2AA198);">u got XSSed</span><span style="color: light-dark(#2AA198, #2AA198);">&#39;</span><span>)</span><span style="color: light-dark(#93A1A1, #586E75);">&lt;</span><span style="color: light-dark(#93A1A1, #586E75);">/</span><span style="color: light-dark(#268BD2, #268BD2);">script</span><span style="color: light-dark(#93A1A1, #586E75);">&gt;</span></span></code></pre> <p>now everyone who opens the page gets a random popup. swap the alert for something stealing session data or cookies that aren’t protected with HttpOnly and it stops being funny real quick.</p> <p>the fix is one line:</p> <pre class="giallo" style="color-scheme: light dark; color: light-dark(#657B83, #839496); background-color: light-dark(#FDF6E3, #002B36);"><code data-lang="javascript"><span class="giallo-l"><span style="color: light-dark(#268BD2, #268BD2);">element</span><span>.</span><span style="color: light-dark(#268BD2, #268BD2);">textContent</span><span style="color: light-dark(#859900, #859900);"> =</span><span style="color: light-dark(#268BD2, #268BD2);"> userComment</span><span>;</span></span></code></pre> <p>this makes the browser treat it as text, not code. that’s genuinely most of the fix for simple cases.</p> <h2 id="the-incident-that-made-me-go-wait-what">The incident that made me go “wait, WHAT”</h2> <p>In 2005, some guy named <a rel="external" href="https://en.wikipedia.org/wiki/Samy_Kamkar">Samy Kamkar</a> found a stored XSS bug on MySpace and turned it into a self replicating JavaScript worm. Anyone who viewed his profile automatically added him as a friend, got the phrase “but most of all, Samy is my hero” added to their profile and unknowingly copied the worm to their own profile too.</p> <p>result: <strong>over 1 million infected profiles in under 20 hours.</strong> MySpace had to shut the whole site down. he also got an FBI visit after, so respect the execution, not the outcome.</p> <h2 id="the-takeaway">The takeaway</h2> <p>Any time you build something that displays user input comments, usernames, profile bios, search results you’re one careless innerHTML away from turning text into executable code. It’s a tiny mistake with surprisingly big consequences and I finally understand why “never trust user input” is one of the first rules of web security.</p> <h2 id="try-it-yourself">Try it yourself</h2> <p>If you want to actually <em>see</em> XSS in action, check out <a rel="external" href="https://xss-game.appspot.com">The XSS Game by Google</a>. It walks you through real scenarios in a safe environment. If you’re curious, here are the solution for the XSS Game levels: https://pastebin.com/hv0h73eC</p>