What is Cross Site Scripting ?
Cross Site Scripting (XSS Attacks)
Cross site scripting is an Attacker executing a malicious code on Victims browser. Usually attacker will inject a script that will display the output of that web application.
The attacker dose not directly target his victim , instead he exploit a vulnerable codes on the website that victim visit.
For Example:
This is a sample code of a web application .
print "<html>"
print "Latest comment:"
print database.latestComment
print "</html>"
The script assumes that a comment consists only of text. However, since the user input is included directly, an attacker could submit this comment: "
<html>
Latest comment:
<script>hacked it</script>
</html>
When the user's browser loads the page, it will execute whatever JavaScript code is contained inside the
Cross site scripting is an Attacker executing a malicious code on Victims browser. Usually attacker will inject a script that will display the output of that web application.
The attacker dose not directly target his victim , instead he exploit a vulnerable codes on the website that victim visit.
For Example:
This is a sample code of a web application .
print "<html>"
print "Latest comment:"
print database.latestComment
print "</html>"
The script assumes that a comment consists only of text. However, since the user input is included directly, an attacker could submit this comment: "
<script>...</script>". Any user visiting the page would now receive the following response<html>
Latest comment:
<script>hacked it</script>
</html>
When the user's browser loads the page, it will execute whatever JavaScript code is contained inside the
<script> tags. The attacker has now succeeded with his attack. 
Comments
Post a Comment