Menu
My understanding of XSS attacks focused on people entering malicious input via forms (persistant XSS attack).
However I'm trying to understand non persistant. Is this as an example (obviously the alert could be substituted for something more sinister...)
http://localhost/MyProject/action.do?Title=<script>alert('XSS');</script>
615
These are: Reflected XSS, where the malicious script comes from the current HTTP request. Stored XSS, where the malicious script comes from the website's database. DOM-based XSS, where the vulnerability exists in client-side code rather than server-side code.
The easiest way to detect XSS vulnerabilities is to use a vulnerability scanner. You can implement manual code checks in a Web page. If you are not a coding expert, you might find this task difficult.
Examples of reflected cross-site scripting attacks include when an attacker stores malicious script in the data sent from a website's search or contact form. A typical example of reflected cross-site scripting is a search form, where visitors sends their search query to the server, and only they see the result.
Typical XSS attacks include session stealing, account takeover, MFA bypass, DOM node replacement or defacement (such as trojan login panels), attacks against the user's browser such as malicious software downloads, key logging, and other client-side attacks.
One problem with that link, though, is <tags> typically aren't allowed in URLs without URL encoding them first. So mailing that link around or posting it wouldn't do you much good.
The more realistic URL encoded form of it would be ..
http://localhost/MyProject/action.do?Title=%3Cscript%3Ealert%28%27XSS%27%29%3B%3C%2Fscript%3E%
After clicking on this URL, the destination web server would unescape the Title value and if ...
<script>alert('XSS');</script>
... is written as-is without being HTML escaped to the page, that's absolutely XSS.
150
Yes, pretty much, consider if you have logged in, those script can also access your cookies and could send it to everywhere.
39
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
