Skip to content

Cybersecurity Atlasby Jer Catallo

Cybersecurity Atlas

One reference surface for application, cloud and product security.

API documentation

Find & Respond

AppSec Playbook
Vulnerabilities Atlas

Build & Harden

Hardening Atlas
Security Tooling

Learn the Fundamentals

Security Concepts

Resources

OWASP Top 10
MITRE ATT&CK
NIST Cybersecurity Framework

© 2026 Jer Catallo. Reference material only, always confirm against the official source.

About
API Documentation

Cross-Site Scripting (XSS) incident response playbook · Cybersecurity Atlas

Home
Playbook
Cross-Site Scripting (XSS)

Cross-Site Scripting (XSS)

HighWeb Application SecurityA03:2021 – Injection

Malicious scripts are injected into web pages viewed by other users, enabling session hijacking, credential theft, and DOM manipulation.

Immediate Response

1Identify and sanitize or remove all stored malicious payloads from the database.
2Invalidate affected user sessions and force re-authentication.
3Deploy a strict Content-Security-Policy header to block inline script execution.
4Enable CSP report-uri to surface further exploitation attempts.

Short-term Remediation

1Apply context-aware output encoding for all user-controlled data (HTML, JS, CSS, URL contexts).
2Use a proven sanitization library (e.g., DOMPurify for client-side, OWASP Java Encoder for server-side).
3Set HttpOnly and Secure flags on all session cookies.
4Validate and restrict allowed HTML tags using an allowlist when rich text is required.

Long-term Prevention

1Adopt a framework with built-in auto-escaping (React JSX, Angular templates, Jinja2 autoescaping).
2Implement a strict CSP in all environments including subdomains.
3Run automated DAST scans with XSS payloads on every pull request.
4Conduct regular developer training on safe rendering practices.

Attack vectors

Reflected XSS via URL parameters rendered without encoding
Stored XSS through user-generated content persisted in the database
DOM-based XSS via client-side JavaScript manipulation of the DOM
Mutation XSS exploiting HTML parser inconsistencies

Indicators of compromise

Script tags or event handlers in user-submitted content fields
Unusual outbound requests to attacker-controlled domains in browser logs
Anomalous cookie or session data being transmitted externally
Content-Security-Policy violation reports

Tooling

DOMPurifyOWASP ZAPBurp SuiteCSP EvaluatorSemgrep

References

owasp.org/www-community/attacks/xss/
cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html