DECONSTRUCTING CROSS-SITE SCRIPT ING (XSS) EXPLOITATION: A STAGE-WISE EVALUATION OF COOKIE AND BROWSER-BASED DEFENCE MECHANISMS IN MODERN WEB APPLICATIONS

Abstract

Cross-Site Scripting (XSS) is a dangerous problem in web applications in which at tackers inject malicious scripts and bypass security controls. In the worst scenario, the attacker steals the session and login token and illegally takes access to the victim’s ac count. In this study, XSS attacks are described in detail, and the attack is divided into four major stages: persistence, execution, egress, and replay. Previous studies mainly focus on detecting XSS attacks and classifying them, whereas this study explains the whole process of how an attack progresses from vulnerability to session hijack. By implementing the demo prototype for a web application, this study demonstrates that a stored XSS attack leads to session-cookie exposure and session hijacking in a controlled research setting. The study also examines the effectiveness of preventing HttpOnly, SameSite and CSP-like security prevention attacks at each stage. The find ings demonstrate that cookie-based protection protects tokens or cookies from theft, and browser-based protection provides higher security by preventing scripts from exe cuting. However, the effectiveness of these protections depends on real-world factors such as proper configuration, deployment, and the complexity of the application. According to the study for strong security, a “defence in depth” strategy should be used, which means that at different stages, multiple security layers should be used to prevent an attack. Using a combination of demonstration and evaluation, the research presents a systematic overview of the XSS attack and the ways to strengthen the security of Web applications in the highly complex situation.