跨网站指令码（Cross-site scripting，通常简称为XSS）介绍

最新推荐文章于 2025-05-16 17:56:44 发布

最新推荐文章于 2025-05-16 17:56:44 发布 · 148 阅读

文章标签：

#CSS #资讯 #Web #Google #Security

本文探讨了XSS（跨站脚本）攻击的概念及其工作原理。XSS是一种通过恶意注入代码来利用网页应用程序漏洞的安全威胁，它能绕过同源策略获取敏感信息。文章还提到了XSS曾被称作CSS，但为了避免与层叠样式表混淆，现已不再使用这一简称。

这是一种很危险的攻击方式，原因在于网路程序的自身漏洞，采取代码注入。

XSS则是利用网站的安全漏洞，将程序码注入网站中，藉以绕过Same origin policy限制，以取得资讯。Cross-site scripting的缩写是CSS，但因为CSS已经被广泛指层叠样式表（Cascading Style Sheets），所以将第一个Cross以X缩写。（http://zh.wikipedia.org/wiki/XSS）

Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications which allow code injection by malicious web users into the web pages viewed by other users. Examples of such code include HTML code and client-side scripts. An exploited cross-site scripting vulnerability can be used by attackers to bypass access controls such as the same origin policy. Vulnerabilities of this kind have been exploited to craft powerful phishing attacks and browser exploits. Cross-site scripting was originally referred to as CSS, although this usage has been largely discontinued (see Terminology below).（http://en.wikipedia.org/wiki/Xss）