Cross-site scripting - Wikipedia, the free encyclopedia

This link has been bookmarked by 160 people . It was first bookmarked on 13 Oct 2007, by Eugene Ilyichev.

11 May 15

György Hévizi
- inject client-side scripts
- viewed by other users
- to bypass access controls such as the same-origin policy
- 84% of all security vulnerabilities
- inject client-side script into Web pages viewed by other users
- content from one site
- access resources
- content from any URL with the same
- (1) URI scheme, (2) host name, and (3) port number
- will share these permissions
- vulnerabilities in web-based applications, their servers, or the plug-in systems
- attackers fold malicious content
- resulting combined content
- delivered from the trusted source
- an attacker can gain elevated access-privileges to sensitive page content, to session cookies
- non-persistent
- two primary flavors
- and persistent
- used immediately by server-side scripts to parse and display a page
- without properly sanitizing the request
- any non-validated user-supplied data included in the resulting page without proper HTML encoding, may lead to markup injection
- The persistent (or stored)
- when the data provided by the attacker is saved by the server, and then permanently displayed on "normal" pages
- If the script is enclosed inside a <script> element, it won't be shown on the screen.
- Her script is run automatically by the browser and steals a copy of Bob’s real name and email directly from his own machine.
- an attacker's malicious script is rendered automatically, without the need to individually target victims or lure them to a third-party website
24 more annotations...
03 May 15

timharding007
xss security wikipedia
01 Mar 15

Livern Chin
code hack
24 Jun 14

austinxie
03 Jun 14

jsa368
- XSS enables attackers to inject client-side script into Web pages viewed by other users.
12 Feb 14

matei
- A reflected attack is typically delivered via email or a neutral web site. The bait is an innocent-looking URL, pointing to a trusted site but containing the XSS vector. If the trusted site is vulnerable to the vector, clicking the link can cause the victim's browser to execute the injected script.
16 Jan 14

asterrol
- SS enables attackers to inject client-side script into Web pages viewed by other users.
- A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same origin policy.
- Cross-site scripting uses known vulnerabilities in web-based applications, their servers, or plug-in systems on which they rely.
- By finding ways of injecting malicious scripts into web pages, an attacker can gain elevated access-privileges to sensitive page content, session cookies, and a variety of other information maintained by the browser on behalf of the user. Cross-site scripting attacks are therefore a special case of code injection.
2 more annotations...
22 Nov 13

afadel
security vulnerability attacks XSS cross site scripting
14 Nov 13

Emac Shen
security
- XSS enables attackers to inject client-side script into Web pages viewed by other users.
- The primary defense mechanism to stop XSS is contextual output encoding/escaping.
24 Aug 13

Steven Josselson
Cross-site scripting - Wikipedia, the free encyclopedia

IFTTT Delicious
18 Jul 13

Ukiringo Freeze
- enables attackers to inject client-side script into Web pages viewed by other users
25 Jun 13

omv999
- By finding ways of injecting malicious scripts into web pages, an attacker can gain elevated access-privileges to sensitive page content, session cookies, and a variety of other information maintained by the browser on behalf of the user. Cross-site scripting attacks are therefore a special case of code injection.
11 Jun 13

Selenite Vingt-Neuf
Cross-site scripting (XSS) is a type of computer security vulnerability typically found in Web applications. XSS enables attackers to inject client-side script into Web pages viewed by other users. A cross-site scripting vulnerability may be used by attac

definition xss web development security
21 May 13

Leticia Snyder
- men's browsers when they visit her profile
- er own server, which collects this inform
- is her script to steal names and emails.
- Bob's website allows Alice to log in with a username/pa
- a reflected XSS vulnerability
- his is the actual XSS vulnerability
4 more annotations...
22 Nov 12

haiitskarthick
- Cross-site scripting (XSS) is a type of computer security vulnerability typically found in Web applications. Due to breaches of browser security, XSS enables attackers to inject client-side script into Web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same origin policy. Cross-site scripting carried out on websites accounted for roughly 84% of all security vulnerabilities documented by Symantec as of 2007.^[1] Their effect may range from a petty nuisance to a significant security risk, depending on the sensitivity of the data handled by the vulnerable site and the nature of any security mitigation implemented by the site's owner.
17 Oct 12

juandeee
- Non-persistent
- the most common type
- is typically delivered via email or a neutral web site
- more devastating
- saved by the server
- displayed
- to other users
- social networking sites
- to self-propagate across accounts
- can be used to send Alice's session cookie to Mallory
8 more annotations...
11 Oct 12

Marco Antonio Almeida
22 Sep 12

Joel Gogwim
security xss Web ajax scripting code javascript
27 Jul 12

Robert Ensink
security
02 Mar 12

carlos puentes
Cross-site scripting (XSS) is a type of computer security vulnerability typically found in Web applications that enables attackers to inject client-side script into Web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same origin policy. Cross-site scripting carried out on websites accounted for roughly 80.5% of all security vulnerabilities documented by Symantec as of 2007.[1] Their effect may range from a petty nuisance to a significant security risk, depending on the sensitivity of the data handled by the vulnerable site and the nature of any security mitigation implemented by the site's owner.

security xss Web javascript code wikipedia ajax scripting
21 Feb 12

Mac Dillon
"http://search.twitter.com/search.atom?q=malware"

xss hack
yuanye
- There is no single, standardized classification of cross-site scripting flaws, but most experts distinguish between at least two primary flavors of XSS: non-persistent and persistent. Some sources further divide these two groups into traditional (caused by server-side code flaws) and DOM-based (in client-side code).
18 Feb 12

Marc-Alexandre Gagnon
security xss Web wikipedia javascript code ajax scripting
14 Feb 12

prashmittanay
- Non-persistent
- Cross-site scripting
- computer security vulnerability
- found in Web applications
- enables attackers to inject client-side script into Web pages viewed by other users
- used by
- vulnerability
- bypass access controls
- attackers
- allow attackers to bypass client-side security mechanisms
- web-application vulnerabilities
- attacker can gain
- web pages
- injecting malicious scripts
- elevated access-privileges
- sensitive page content, session cookies
- information maintained by the browser
- special case of code injection.
- "cross-site scripting"
- act of loading the attacked
- hird-party web application
- from an unrelated attack site
- manner
- a reflected or non-persistent XSS vulnerability
- the security context of the targeted domain
- executes a fragment of JavaScript
- non-persistent and persistent
- traditional (caused by server-side code flaws) and DOM-based (in client-side code).
- divide these two groups
- Non-persistent
- most common type
- Persistent
- Traditional versus DOM-based vulnerabilities
31 more annotations...
06 Feb 12

Radoslaw Tomaszewski
security attack hacking xss_cross_site_scripting code_injection vulnerability web browser cookie javascript
29 Dec 11

marco_antonio_almeida_silva
html security cross-site scripting
14 Dec 11

Jacob Golbitz
xss cross_site_scripting software_security
03 Aug 11

anthony zhan
- bypass
- nuisance
08 Jul 11

Ed Mullen
Xframe
- Prominent sites affected in the past include the social-networking sites Twitter,^[3] Facebook,^[4] MySpace, and Orkut.^[5]^[6] In recent years, cross-site scripting flaws surpassed buffer overflows to become the most common publicly-reported security vulnerability,^[7] with some researchers viewing as many as 68% of websites as likely open to XSS attacks.^[8]
- The non-persistent (or reflected) cross-site scripting vulnerability is by far the most common type.^[10] These holes show up when the data provided by a web client, most commonly in HTTP query parameters or in HTML form submissions, is used immediately by server-side scripts to generate a page of results for that user, without properly sanitizing the request.^[11]
11 Apr 11

uygosmv
- found in web applications that enables malicious attackers to inject client-side script into web pages viewed by other users
05 Dec 10

Julian Baldwin
Security
11 Nov 10

La Ligne
04 Nov 10

John Li
hacking
02 Oct 10

viniciusjl
wikipedia web security attack cross scripting
25 Sep 10

Lee Johnson
security xss scripting cross-site
21 Sep 10

mario64
xss security
13 Sep 10

sanrodari
- At first blush, this does not appear to be a serious problem: by submitting a malicious input to the web site, the user would only be able to compromise their own security context—that is, their own browser cookies, cache objects, and so forth. It is important to realize, however, that a third-party attacker may easily place hidden frames or deceptive links on unrelated sites and cause victims' browsers to navigate to URLs on the vulnerable site automatically—often completely in the background—and in such a case, the attacker can intrude into the security context that rightfully belonged to the victim.
23 Aug 10

Alin Cosmanescu
12 Aug 10

James Otto
"Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications that enables malicious attackers to inject client-side script into web pages viewed by other users."

security web programming development code javascript ajax xss
15 Jun 10

P eter
security xss wikipedia code scripting
12 May 10

jack ferris
XSS) is a type of computer security vulnerability typically found in web applications which allow code injection by malicious web users into the web pages viewed by other users.

code
20 Apr 10

Serhat Sine
security javascript web xss programming wikipedia ajax code scripting
09 Apr 10

Lourdes Rodriguez
Seguridad
02 Apr 10

therin2006
Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications that enables malicious attackers to inject client-side script into web pages viewed by other users.

wikipedia xss security scripting Web cross-site
11 Mar 10

Fabien Cadet
web development security XSS
19 Feb 10

hal90o0
javascript xss security web code ajax programming wikipedia scripting
22 Jan 10

shaleesa frampas
"Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications which enable malicious attackers to inject client-side script into web pages viewed by other users. An exploited cross-site scripting vulnerability can be used by attackers to bypass access controls such as the same origin policy. Cross-site scripting carried out on websites were roughly 80% of all security vulnerabilities documented by Symantec as of 2007.[1] Their impact may range from a petty nuisance to a significant security risk, depending on the sensitivity of the data handled by the vulnerable site, and the nature of any security mitigations implemented by the site's owner."

web-2.0 software
10 Oct 09

mark arashi
06 Oct 09

vittoria caranna
attacchi web - Cross-site scripting
29 Sep 09

zfranciscus
security Javascript web programming ajax development Reference xss
30 Jun 09

Matt Giddings
Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications which allow code injection by malicious web users into the web pages viewed by other users. Examples of such code include client-side scripts. An exploited cross-site scripting vulnerability can be used by attackers to bypass access controls such as the same origin policy. Vulnerabilities of this kind have been exploited to craft powerful phishing attacks and browser exploits. Cross-site scripting carried out on websites were roughly 80% of all documented security vulnerabilities as of 2007.[1] Often during an attack "everything looks fine" to the end-user[2] who may be subject to unauthorized access, theft of sensitive data, and financial loss.

security xss crosssite wikipedia web
02 May 09

Matt B
web_design
14 Apr 09

security software javascript [@delicious]
13 Apr 09

Daniel Ionescu
programming javascript security web ajax code hacks xss cross-site
12 Feb 09

Fernando Sánchez Zamora
security xss
02 Feb 09

varkas
javascript web security
28 Jan 09

Stuart H
javascript programming hack security
06 Jan 09

Lei Shi
security
26 Nov 08

John Rodrigues
security test
18 Nov 08

Eric Fer
php programacao seguranca
29 Oct 08

stephanhuez
websecurity
09 Aug 08

Mike Fruchter
security
09 May 08

Edver Estabillo
css xss javascript attack webattack deface code ajax hacks
04 Apr 08

alfred westerveld
cross site scripting cross-site wikipedia
19 Mar 08

Navneet Kumar
wikipedia xss
26 Feb 08

irahat
security
10 Feb 08

pghobd
terminology web application programming
07 Feb 08

security xss
18 Jan 08

stevoyoung
security tips programming webdesign delicious
19 Dec 07

Ben K
wikipedia hacking security
11 Oct 07

Manimaran vadivel
Web security
21 Aug 07

Mats Svensson
Security Useful UsefulForProject programming webdev
27 Jul 07

Chrys R
security web code hacking
25 Jun 07

rohan_talip
xss
19 May 07

javascript programming reference security xss software web
30 Oct 06

Gert Jan Wolters
_ToDo_
23 Oct 06

Hans Fredrik Nordhaug
Security
21 May 06

Manolis Viennas
digg security ajax web delicious
07 Apr 06

nomadoe moe
hacks