`. He also used `\x6A\x61\x76\x61\x73\x63\x72\x69\x70\x74` (hex encoding of "javascript") to bypass the filter.
### British Airways (2018): 500,000 Payment Cards
In September 2018, British Airways disclosed a breach affecting 500,000 customers who booked flights between August 21 and September 5, 2018. RiskIQ's researchers determined the attackers (Magecart Group 6) injected a 22-line JavaScript skimmer that captured form input from the BA payment page and exfiltrated it to `baways.com` (not the legitimate `britishairways.com`).
The skimmer ran in the browser during checkout and collected:
- Card number, expiry, CVV
- Name, billing address
- Email address
The attack was a supply chain XSS: attackers compromised a third-party JavaScript library loaded on BA's checkout page, injected their skimmer into that library, and it ran automatically on every transaction. BA was fined £20 million by the UK ICO (reduced from an initial £183 million figure). Total estimated theft: ~£14 million in fraudulent charges.
### Twitter XSS (2014): TweetDeck Worm
In June 2014, a self-propagating XSS worm spread across TweetDeck, Twitter's third-party client. A user discovered that TweetDeck was rendering tweet content as HTML and posted a tweet containing ``. TweetDeck executed it. The worm evolved to automatically retweet itself and show pop-up alerts. Thousands of accounts were affected before TweetDeck was taken offline temporarily. No permanent data theft occurred in this case, but the attack demonstrated that a stored XSS in a widely-used client could spread virally.
## Reflected XSS
Reflected XSS is the simplest variant: the payload arrives in the HTTP request (URL parameter, form field, header), the server includes it in the HTML response without sanitization, and the browser executes it. The attack is one-shot: it doesn't persist in the application.
Delivery mechanism: the attacker crafts a malicious URL and gets the victim to visit it. Methods include phishing emails, shortened URLs, social engineering, or open redirectors on the same domain.
### Vulnerable Code
```javascript
// Express.js — vulnerable search endpoint
app.get('/search', (req, res) => {
const query = req.query.q || '';
// VULNERABLE: user input directly in HTML response
res.send(`
Search
ipt>alert(1)ipt>
%253Cscript%253Ealert(1)%253C%252Fscript%253E
alert(1)
Results for: ${query}
Loading...
`);
});
```
Normal request: `GET /search?q=laptops` → renders "Results for: laptops"
Attack URL: `https://target.com/search?q=`
The `
" onmouseover="alert(1)" x="
Click me
```
### Filter Bypass Techniques
When a WAF or input filter blocks specific patterns, these bypass techniques frequently succeed:
```html