Xss Cross Site Scripting may be classified in two types:
1.Persistent XSS
2.Non Persistent XSS
In order to demonstrate a XSS attack I will take an example of a website:
http://www.redwrappings.co.in/Checking the venerability
The simplest way to check the vulnerability is to enter the following code in the any web form present on the website
<script>alert(“XSS”)</script>
Now the attacker has found that the website is velnerable to an xss attack the attacker can do lots of damages to the website, The most common thing which the attacker will do is place his defacement image on that page showing that the website is hacked, For this purpose he will insert a code similar to the below one:
<html><body><IMG SRC=”http://site.com/yourDefaceIMAGE.png”></body></html>Where http://site.com/yourDefaceIMAGE.png is the defacement image
Inserting Flash Videos
The attacker can also insert flash videos by entering the following code in any web form present on the website
Redirection
The attacker can also redirect the page to any particular page , In case if the hacker has managed to find XSS venerability in the a website like paypal.com or alertpay.com he can redirect that page to a Phisher Site(Fake login page) where the victim will loose his password, To redirect a an xssed page to another page the attacker will insert a code similar to the below one:
<script>window.open( “http://www.google.com/” )</script>
Stealing Cookies
Most of the attackers after finding a website venerable to xss will probably steal victims cookies to gain access to their account or private data this method is called Session hijacking, which is a detailed topic and I will be explaining in the later articles
Hope you have learned some XSS ,Feel free to ask if you have any problem regarding the above information
