Detection of cross-site scripting (XSS) attacks: Analysis, detection approaches, and mitigation strategies
Article Sidebar
Main Article Content
Abstract
Cross-Site Scripting (XSS) remains one of the most persistent security vulnerabilities affecting modern web applications. The increasing complexity of web technologies, extensive use of client-side scripting, and processing of user-generated content provide opportunities for attackers to inject malicious scripts into trusted web environments. Successful XSS attacks can lead to session hijacking, credential theft, unauthorized access, and disclosure of sensitive information. This paper analyzes XSS vulnerabilities with a focus on attack characteristics, detection approaches, and mitigation strategies. The research includes a statistical analysis of Common Weakness Enumeration (CWE) vulnerability data collected between 2014 and 2022. The dataset was processed using Python in a Jupyter Notebook to examine the frequency, distribution, and long-term trends of XSS vulnerabilities in comparison with other major software weaknesses. The results indicate that XSS remains among the most frequently reported software weaknesses despite advances in secure development practices and web security mechanisms. The study also examines static, dynamic, hybrid, and machine learning-based detection approaches through an experimental evaluation of selected XSS detection tools. The findings demonstrate that no single technique provides complete protection against all XSS variants, while combined approaches offer more effective vulnerability detection and mitigation. The study emphasizes the importance of secure coding, input validation, output encoding, Content Security Policy (CSP), and automated security testing throughout the software development lifecycle.
Article Details
This work is licensed under a Creative Commons Attribution 4.0 International License.
References
[1] G. A. Di Lucca, A. R. Fasolino, M. Mastroianni, and P. Tramontana, “Identifying cross site scripting vulnerabilities in web applications”, Proceedings. Sixth IEEE International Workshop on Web Site Evolution, 11 September 2004, Chicago (USA), pp. 71–80, https://doi.org/10.1109/WSE.2004.10013, (2004)
[2] OWASP Foundation, “Cross site scripting (XSS)”, Open Worldwide Application Security Project, https://owasp.org/www-community/attacks/xss/
[3] MITRE, “CWE-79: Improper neutralization of input during web page generation (‘cross-site scripting’)”, Common Weakness Enumeration, https://cwe.mitre.org/data/definitions/79.html
[4] OWASP Foundation, “Cross site scripting prevention cheat sheet”, OWASP Cheat Sheet Series, https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
[5] J. Grossman, R. Hansen, P. D. Petkov, A. Rager, and S. Fogie, “XSS attacks: Cross site scripting exploits and defense”, 1st ed., Syngress, Burlington (USA), https://doi.org/10.1016/B978-1-59749-154-9.X5000-8, (2007)
[6] D. Das, U. Sharma, and D. K. Bhattacharyya, “Detection of cross-site scripting attack under multiple scenarios”, The Computer Journal, Vol. 58(4), pp. 808–822, https://doi.org/10.1093/comjnl/bxt133, (2015)
[7] R. Wang, G. Xu, X. Zeng, X. Li, and Z. Feng, “TT-XSS: A novel taint tracking based dynamic detection framework for DOM cross-site scripting”, Journal of Parallel and Distributed Computing, Vol. 118, pp. 100–106, https://doi.org/10.1016/j.jpdc.2017.07.006, (2018)
[8] F. A. Mereani and J. M. Howe, “Detecting cross-site scripting attacks using machine learning”, in The International Conference on Advanced Machine Learning Technologies and Applications (AMLTA2018), A. E. Hassanien, M. F. Tolba, M. Elhoseny, and M. Mostafa, Eds., in Advances in Intelligent Systems and Computing, vol. 723, Springer International Publishing, Cham (Switzerland), pp. 200–210, https://doi.org/10.1007/978-3-319-74690-6_20, (2018)
[9] R. Alhamyani and M. Alshammari, “Machine learning-driven detection of cross-site scripting attacks”, Information, Vol. 15(7), Art. no. 420, https://doi.org/10.3390/info15070420, (2024)
[10] Q. Abu Al-Haija, “Cost-effective detection system of cross-site scripting attacks using hybrid learning approach”, Results in Engineering, Vol. 19, Art. no. 101266, https://doi.org/10.1016/j.rineng.2023.101266, (2023)
[11] ZAP by Checkmarx, “Documentation”, https://www.zaproxy.org/docs/
[12] PortSwigger, “Burp Suite documentation”, https://portswigger.net/burp/documentation, (2026)
[13] Invicti, “Acunetix overview”, https://www.acunetix.com/support/docs/wvs/overview/
[14] OWASP Foundation, “OWASP Web Security Testing Guide”, Open Worldwide Application Security Project, https://owasp.org/www-project-web-security-testing-guide/
[15] G. Bošković, Ž. Kužet, B. Zoraja, V. Mučenski, and Z. Čepić, “Risks and safety management in photovoltaic systems”, Engineering TODAY, Vol. 5(1), pp. 43–48, https://doi.org/10.5937/engtoday2600014B, (2026)
[16] B. R. K. Mantha, Y. Jung, and B. Garcia de Soto, “Implementation of the Common Vulnerability Scoring System to assess the cyber vulnerability in construction projects”, Proceedings of the Creative Construction e-Conference 2020, 28 June–1 July 2020, Online, pp. 117–124, https://doi.org/10.3311/CCC2020-030, (2020)
[17] I. Hydara, A. B. M. Sultan, H. Zulzalil, and N. Admodisastro, “Current state of research on cross-site scripting (XSS) – A systematic literature review”, Information and Software Technology, Vol. 58, pp. 170–186, https://doi.org/10.1016/j.infsof.2014.07.010, (2015)
[18] A. Panović and V. Ružičić, “Implementation of the ISO/IEC 42001 standard in organizational environment and modern information systems”, Proceedings of the 13th International Conference on Electrical, Electronics and Computer Engineering (IcETRAN), 8–11 June 2026, Silver Lake (Serbia), pp. 214–219, https://doi.org/10.69994/13Ic26041, (2026)
[19] A. Hannousse, S. Yahiouche, and M. C. Nait-Hamoud, “Twenty-two years since revealing cross-site scripting attacks: A systematic mapping and a comprehensive survey”, Computer Science Review, Vol. 52, Art. no. 100634, https://doi.org/10.1016/j.cosrev.2024.100634, (2024)
[20] I. F. Khazal and M. A. Hussain, “Server side method to detect and prevent stored XSS attack”, Iraqi Journal for Electrical and Electronic Engineering, Vol. 17(2), pp. 58–65, https://doi.org/10.37917/ijeee.17.2.8, (2021)