Attack scenario
Client-side injection and Cross-Site Scripting
An adversary injects untrusted content into a user's browser and executes script in the context of a trusted application.
Why this scenario matters
Stored, reflected, or DOM-based XSS may steal sessions, modify page content, perform actions as the user, capture data, or create another account-takeover path. The source may be the application, API, widget, tag manager, or a third-party script.
Protection combines contextual output encoding, safe DOM APIs, sanitization, CSP, cookie protection, SAST and DAST, client-side telemetry, and third-party script governance.
The scenario uses MITRE ATT&CK® as a reference model. It is an expert SecTec interpretation and does not imply endorsement by MITRE.
Relevant ATT&CK tactics
- Credential Access
- Execution
- Initial Access
Relevant ATT&CK techniques
Reference frameworks
SecTec technologies and vendors
The following hierarchy is derived from the approved ATT&CK-to-technology and technology-to-vendor mappings.