What is XSS and how can it be detected in a pentest?

• A. Cross-Site Scripting is injecting scripts into web pages; detected by inputting script payloads and observing reflected or stored output in responses.
• B. A method for rate-limiting sessions.
• C. An authentication technique using multi-factor.
• D. XSS is a type of SQL injection.

Answer: (A)

XSS is a vulnerability where attacker-supplied scripts run in other users’ browsers because the application mishandles untrusted input. In a pentest you detect it by injecting script payloads into inputs, URLs, or other user-supplied fields and then checking if the payload appears in the response or is stored and later served back to users, or if it actually executes in the browser (for example, via a visible alert or a DOM change). If you see the script reflected in the HTML or executed in the page, that indicates XSS. There are reflected, stored, and DOM-based variants, but the testing approach is to submit payloads and observe execution or reflection. This isn’t about rate-limiting, multi-factor authentication, or SQL injection, which address different security concerns.