Cross-Site Scripting (XSS) attacks are still very common today. It is a type of injection attack where an attacker injects malicious scripts or code into requests sent by the web application. These attacks succeed due to user input not being validated correctly before it's sent to the server.

There were initially two types of XSS, but, in 2005, a third was discovered:

• Stored XSS: Storage XSS occurs when the user input is stored on the target server and is not validated. The storage can be a database, forum, or comment field. The victim unknowingly retrieves the stored data from the web app, which the browser thinks is safe to render because of the inherent trust between the client and server. Because the input is actually stored, Stored XSS is considered to be persistent or permanent.

• Reflected XSS: Reflected XSS occurs when user input is immediately returned by a web app in the form of an error message, search result, or any other response that includes some or all of the input provided by the user as part of the request, without that data being made safe to render in the browser, and without permanently storing the user provided data.

• DOM XSS: The Document Object Model (DOM) is a programming API for HTML and XML documents. It defines the logical structure of documents and the way a document is accessed and manipulated. DOM-based XSS is a form of XSS where the entire tainted data flow from source to sink takes place in the browser, that is, the source of the data is in the DOM, the sink is also in the DOM, and the data flow never leaves the browser.