Those of us who interact with or manage the results from
penetration testing teams all (hopefully!) understand the
ramifications when a XSS vulnerability is found. We may even all
understand the differences between a reflected XSS vulnerability
and a persistent (stored) XSS vulnerability. What about those
higher up the food chain? Do those who interact with the
executives within an organisation fully understand the risks
from a XSS vulnerability? Do they paint a realistic picture to
those who are ultimately responsible for said website of just
what is possible? A reflected XSS vulnerability is when ‘code’
is injected into a website in such a way so as to deliver a
payload or to produce a result on the end users browser.
Reflected XSS vulnerabilities are delivered to a victim via
various means such as an email causing the user to click on a
malicious URL which in itself normally contains the malicious
‘code’. A persistent XSS vulnerability is one in which the
‘code’ is actually injected into the website itself