== What is XSS

Cross-site script (also commonly known as XSS) is a vulnerability/flaw that combines ...
# the allowance of html/script tags as input that are ...
# rendred into a browser without encoding or sanitization

=== Cross site scripting (XSS) is the most prevalent and pernicious web application security issue

While there is a simple well-known defense for this attack, there are still many instances of it on the web.  In terms of fixing it,
coverage of fixes also tends to be a problem. We'll talk more about the defense in a little bit.

=== XSS has a significant impact

Especially as 'Rich Internet Applications' are more and more common place, privileged function calls linked to via javascript may be compromised.
And if not properly protected, sensitive data (such as your authentication cookies) can be stolen and used for someone else's purpose.


==== Quick examples:
* From the browser address bar (chrome, Firefox)
+
----
javascript:alert("XSS Test");
javascript:alert(document.cookie);
----
* Any data field that is returned to the client is potentially injectable
+
----
<script>alert("XSS Test")</script>
----

== Try It!  Using Chrome or Firefox 

* Open a second tab and use the same url as this page you are currently on (or any url within this instance of WebGoat)
* Then, in the address bar on each tab, type `javascript:alert(document.cookie);` *NOTE:* If you /cut/paste you'll need to add the `javascript:` back in.
