Mastering Kali Linux for Web Penetration Testing

Should XSS stay or should it go?

XSS attacks, regardless of where they take place, can be either stored or reflective. Both can range from annoying to gravely serious, depending on the intent and the impacted session's context:

• Stored XSS attacks (persistent) are quite common where data from an attacker masquerading as a legitimate user is not properly screened before being presented to other users. This code will persist, continuing to impact users until it is detected, the data purged, or precautions implemented on the web service to ensure that responses containing the code are properly validated. In effect, the code is stored in the server itself, as shown here:

Stored XSS will attack any client viewing the requested page.

• Reflective ...