SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/secplus-xss-script-injection

Which web attack injects malicious scripts into otherwise trusted websites so they run in other users' browsers?

Cross-site scripting, malicious script delivered through a trusted site.

Start playing free

  1. SQL injection
  2. Buffer overflow
  3. Cross-site scripting (XSS) ✔

Why: The site fails to clean user input and sends it back to other visitors, whose browsers run it. Attackers can steal session tokens or change what the page shows.

Huh, didn't know that: OWASP calls XSS a type of injection attack.

The dad joke
The website trusted all user input. The browsers ran everything. The scripts took a vacation.
Like this card?
Play the game

References

Answer: Cross-site scripting (XSS). The site fails to clean user input and sends it back to other visitors, whose browsers run it. Attackers can steal session tokens or change what the page shows.

  1. OWASP, Cross Site Scripting (XSS) owasp.org/www-community/attacks/xss
    Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites.
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyWhich web attack inserts a database query into an input field that the application then runs?Security & PrivacyWhich attack forces a logged-in user's browser to perform an action they did not intend?Security & PrivacyUsing sequences like ../ to reach files outside a web application's folder is called what?

That's stuff everyone should know.