XSS, cross-site scripting, is a web vulnerability where an attacker injects a script that runs in other users' browsers, in the context of the vulnerable site. It can steal session data or act as the victim. It is cataloged as CWE-79.
Example
A comment box prints your text without escaping it. Posting this runs in the browser of anyone who views the comment:
<script>fetch('/admin/flag').then(r => r.text()).then(t => ...)</script>CTF versions often include an admin bot that visits your page, so the script runs as the admin and can read a page you cannot. Stored XSS saves the payload on the server; reflected XSS returns it from a URL parameter.
How it is fixed
- Escape output for the context it lands in.
- Set a Content Security Policy.
- Mark session cookies
HttpOnly.
On CTF7
Web challenges that need a running application can run as isolated per-team lab instances, so your testing stays inside your team's environment. Raw Ops events score XSS reports by severity with CVSS 4.0.
Learn more
Read the web exploitation guide for worked examples and tools, or browse all CTF guides.
Related terms
Browse the full CTF and cybersecurity glossary for more terms.
