Understanding cross-site scripting

- [Instructor] Let's now turn our attention … to a variety of attacks focused on web applications. … Almost every business runs web applications these days … and those applications often store, process, and transmit … sensitive information. … These web applications sometimes serve the public, … so firewalls and other security devices are configured … to allow access to them from the Internet. … If web applications aren't written … with sound security practices in mind, … they can present a major vulnerability to the organization. … Let's take a look at one such vulnerability, … the cross-site scripting attack, often abbreviated as XSS. … In a cross-site scripting attack, … the attacker places a malicious script on a site … that contains instructions directing a web browser … to access a second site. … Then the attack waits. … When a victim visits the site, the victim's browser … unknowingly downloads and runs the code … that attempts to access the second site. … If the victim is already logged into the second site, …