XSSCross-Site Scripting
Definition
Vulnerability where attacker-controlled JavaScript executes in a victim's browser under a trusted domain's context. Session theft, account takeover, and targeted phishing.
Three flavours: Reflected (payload in URL/params, reflected unsanitised), Stored (payload persists in backend and triggers when others load it), DOM-based (injection happens client-side via insecure JS).
Impact in bug bounty: depends on scope and domain. XSS on login = ATO via cookie theft → high payout. XSS on the main site with HttpOnly cookies → reduced impact (defacement, phishing). Persistent stored XSS on someone else's profile = the classic juicy one.
Modern defence: strict CSP (no inline scripts, nonce per request), context-aware encoding (HTML, URL, JS, CSS are distinct), framework templating that escapes by default (React JSX, Vue {{ }}).