Now we will discuss cross site scripting attack in an actual injection attack and attacker goes after
our labor Web site to target it store data such as user credential or sensitive financial data.
But if attacker would rather directly target a Web site user, they may opt for a cross site scripting
attack similar to an actual injection attack.
This attack also involves injecting malicious code into a Web site, but in this case, the website
itself is not being attacked.
Instead, the malicious code the attacker has injected only runs in the user's browser when they visit
the attack website.
And it goes after the visitor directly, not the website.
One of the most common way an attacker can deploy across that scripting attack is by injecting malicious
code into a comment or a script that could automatically run.
For example, they could embed a link to a malicious JavaScript in a comment on a blog cross site.
Scripting attacks can significantly damage a website for reputation by placing the user's information
at risk without any indication that anything malicious even occurred at any sensitive information or
user sent to a site such as their credential, credit card information or other private data can be
hijacked via crosschecks scripting without the Web site's owners realizing that there were there was
even a problem in the first place to understand Crossette scripting attack by this image in five simple
steps.
First of all, Attacker discovers a website for having a script injection of vulnerabilities.
After finding vulnerable website, the attacker injects a pilot into a database with a malicious JavaScript
that steal cookies from their database.
In the third step, the Web site transmitted the victim's browser, the page with the attackers payload,
then the victim's browser.
Execute Demolisher script in step after script.
Execution Victim sends his cookies to the attacker in the fifth and the last step, the attacker extract
victim's cookie after which he use it for sition hijacking and his personal use.
In this way, crosseyed scripting attack works.