[WEB SECURITY] XSS Question
robert at webappsec.org
Thu Jun 23 12:22:07 EDT 2011
Certainly more than popup boxes are possible :) I would advise checking
out the following articles which explain abuse cases for XSS.
Worms and malware section
XSS wikipedia exploit scenarios section
During a recent web pentest I found an input vulnerable to XSS. The developers have come back to me saying they resolved the issue, but upon retesting I found it still vulnerable to the following string: \";alert('XSS');//
Just for my own education, can anything malicious be done with such a string or is the extent of the damage a popup box (which is what I currently get).
More information about the websecurity