# Phishing Attacks Survey: Types, Vectors, and Technical Approaches
## 3 Phishing Methods and Techniques
### Phishing Technical Approaches
#### 3.3.4 Cross-Site Scripting (XSS)  
Modern websites often use client-side scripting to improve a user's experience. Unfortunately, this leaves the client open to a form of attack known as cross-site scripting (XSS or CSS). XSS is similar to SQL injection in that it is a form of code injection. However, unlike SQL, which targets the query function of databases, XSS targets the HTML outputs. The code may be written in languages such as Java, NET, or PHP. This exploit is present in many websites that are poorly constructed and do not sanitize user inputs, which in turn provides the opportunity for malicious actors to insert their code [45; 46]. The code itself may be injected into data fields within a website or into the URL of a website with this vulnerability.  
The reason XSS attacks are implemented is to bypass the same-origin policy (SOP). This policy states that scripts loaded from one domain may not access the data that belongs to any other domain. Thus, login credentials and other personal information should not be accessible to websites other than the one to which they belong. During an XSS attack, this policy is circumvented as the malicious script is run when the victim loads the webpage in their browser. This script will then attempt to access the sensitive data stored in the victim's browser, such as cookies, and then transfer it to the phisher's secure server. Using this information, a phisher can then gain access to the user's account and impersonate them.  
There are two basic methods by which cross-site scripting can take place. These are stored XSS and reflected XSS. Of these two methods, stored XSS (also known as persistent XXS) has the greatest impact. In this method, malicious code is stored on a web applications server as a resource (for example, in a database), to be accessed by everyone who accesses that specific resource. The attack itself is not launched until the victim requests the generation of a dynamic webpage that includes the use of the resource that hold this malicious code. An example of this type of request is a comments section, blog, or bulletin board where, if the script is not sterilized, the victim loads a webpage on which the attacker previously made a comment that contained a script. When the page is loaded by any subsequent user, their browser executes the script and, while the user reads the comment, their personal data is extracted and captured on the attacker's server. This process continues until the script is removed.  
The second type of cross-site scripting attack is reflected XSS. In this instance, the script is not permanently stored, rather the script is \"reflected\" back at the user immediately. In this method the phisher can send a specially crafted link that is aimed at a HTTP query that contains the malicious code as a parameter that, when the victim clicks the link, is submitted and the code is immediately \"reflected\" at the victim in the form of the webpage showing the results of the query. When the script runs, the victim's personal data is stolen and transmitted to the attacker.