XSS and JavaScript – a deadly combination
Hackers have been very creative when exploiting the XSS flaw and with the help of JavaScript, the attack possibilities increase. XSS combined with JavaScript can be used for the following types of attacks:
- Account hijacking
- Altering contents
- Defacing complete website
- Running a port scan from the victim's machine
- Log key strokes
- Stealing browser information
Let's discuss a few examples.
Cookie stealing
In every discussion of XSS attack, the first thing that we talk about is how cookies can be compromised using XSS and JavaScript. The stolen cookie can then be used by the attacker to impersonate the victim for the duration of the session until the user logs out of the application.
The document.cookie property of the ...
Get Penetration Testing: A Survival Guide now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
