Cgisecurity.com: Cross Site Scripting questions and answers

24 Jun 16

study web pages

28 Sep 11

Isidro Vila Verde

xss security si2007

27 Mar 09

Gustavo Delfino

imported Bookmarks Computación Web_Development

24 Nov 08

Richard Chadwick

xss hacks

12 Nov 08

Sergio V

xss security scripting crosssitescripting hacking

06 Nov 08

ericwryan

21 Oct 08

Jesus Bello

Often attackers will inject JavaScript, VBScript, ActiveX, HTML, or Flash into a vulnerable application to fool a user (Read below for further details) in order to gather data from them. Everything from account hijacking, changing of user settings, cookie theft/poisoning, or false advertising is possible. New malicious uses are being found every day for XSS attacks. The post below by Brett Moore brings up a good point with regard to "Denial Of Service", and potential "auto-attacking" of hosts if a user simply reads a post on a message board.
Since XSS holes are different in how they are exploited, some testing will need to be done in order to make the output believable. By inserting code into the script, its output will be changed and the page may appear broken. (The end result is crucial and the attacker will have to do some touching up in the code to make the page appear normal.) Next you will need to insert some Javascript (or other client side scripting language) into the URL pointing to the part of the site which is vulnerable. Below I have provided a few links that are for public use when testing for XSS holes. These links below, when clicked on will send the users cookie to www.cgisecurity.com/cgi-bin/cookie.cgi and will display it. If you see a page displaying a cookie then session hijacking of the user's account may be possible.

25 Sep 08

Bob Carr

xss

11 Sep 08

allenown

General

27 Aug 08

Andres Cuervo Adame

xss seguridad

19 Jul 08

dinh cuong vu

xss security hacking

15 May 08

Tammy Lee

XSS

15 Apr 08

Ludo Vangilbergen

Websites today are more complex than ever, containing a lot of dynamic content making the experience for the user more enjoyable. Dynamic content is achieved through the use of web applications which can deliver different output to a user depending on their settings and needs. Dynamic websites suffer from a threat that static websites don't, called "Cross Site Scripting" (or XSS dubbed by other security professionals). Currently small informational tidbits about Cross Site Scripting holes exist but none really explain them to an average person or administrator. This FAQ was written to provide a better understanding of this emerging threat, and to give guidance on detection and prevention.

security programming web design

07 Apr 08

ajam ullu

security

10 Mar 08

Michel Duijvestijn

xss CrossSiteScripting

uitgebreide site over cross site scripting met onder andere uitleg over gebruikte methodieken om standaard defensiemethoden te verschalken

06 Mar 08

seba gore

security xss development programming javascript

19 Dec 07

santhu

security xss

13 Dec 07

sudhirp

security xss web

06 Dec 07

kartoch

faq hacking javascript programming security web xss

03 Oct 07

otterfall

security php javascript

10 Jul 07

jeff huang

cookie steal xss

03 Jul 07

Joe B

A nice article that explains clearly everything about XSS

*** .article security webdev programming

24 Jun 07

Christian Stocker

xss security javascript

05 Jun 07

Jason G

security hacking xss webdev scripts testing injection

31 Mar 07

Gavin Terrill

xss webdesign

01 Mar 07

diigodeli dunbar

Cross site scripting (also known as XSS) occurs when a web application gathers malicious data from a user. The data is usually gathered in the form of a hyperlink which contains malicious content within it. The user will most likely click on this link fro

web security xss faq

26 Feb 07

Andrea Glorioso

programming web security

04 Jan 07

sanjayuttam

xss Security

02 Jan 07

Eric Harris-Braun

xss security

23 Nov 06

Keith Lo

security

ChinLung Shih

security XSS javascript scripting faq programming

23 Oct 06

Christian Sax

Explains the XSS Cross Site Scripting step by stey alike a FAQ

XSS security programming Javascript attack

10 Oct 06

Bisio

hacking imported:del.icio.us security xss

07 Oct 06

Serise Lange

css imported:del.icio.us programming security web xss

26 Sep 06

Vitaliy Podoba

programming

25 Sep 06

Steve Goguen

XSS Javascript security hacking AJAX

Joe Yates

XSS FAQ security

benpjohnson

XSS security Javascript Scripting faq

Ignacio Silva

hacking security reference programming jsp

Brian Lowry

xss

Puck Twisted

xss security programming

Jim Weinhold

21 Sep 06

Robin Carriere

security XSS Javascript programming web

27 Aug 06

Shawn Hartsock

ajax browser faq howto javascript programming scripting security toread web xss

Jukkhapong Pliankam

Step 3: XSS Execution

  Hand out your crafted url or use email or other related software to help launch it. Make sure that if you provide the URL to the user(through email, aim, or other means) that you at least HEX encode it. The code is obviously suspicious looking but a bunch of hex characters may fool a few people.

In my example I only forward the user to cookie.cgi. A attacker with more time could do a few redirects and XSS combo's to steal the user's cookie, and return them to the website without noticing the cookie theft.
Some email programs may execute the Javascript upon the opening of a message or if the Javascript is contained in a message attachment. Larger sites like Hotmail do allow Javascript inside attachments but they do special filtering to prevent cookie theft.