[+] Introduction
wikipedia definition for XSS is “Cross-site scripting (XSS) is a type of computer insecurity
vulnerability typically found in Web applications (such as web browsers through breaches of browser
security) that enables attackers to inject client-side script into Web pages viewed by other users.
A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the
same origin policy. Cross-site scripting carried out on websites accounted for roughly 80.5% of all
security vulnerabilities documented by Symantec as of 2007.Their effect may range from a petty
nuisance to a significant security risk, depending on the sensitivity of the data handled by the
vulnerable site and the nature of any security mitigation implemented by the site's owner.”
Simply 'XSS' also known as 'CSS' (Cross Site Scripting, Easily confused with 'Cascading Style
Sheets') is a very common vulnerability found in Web Applications, 'XSS' allows the attacker to
inject malicious code , the reason of that is the developer trusts user inputs, or mis filtering issues ,
then send back user input data to the client browser so the malicious code will execute.
[+] XSS is Dangerous
XSS is really dangerous , it's severity is High, because it could change the website DOM and could
lead to stealing credentials of the administrator , in these cases the attacker can control and
compromise the whole application.
[+] What does the attacker want to achieve?
• Changing Setting
• Cookie theft
• False Advertising
• Steal a Form Tokens to make CSRF Easier
• And more , you have to be creative to exploit XSS.
