XSS Cross Site Scripting Attack

Xss Cross Site Scripting may be classified in two types:

1.Persistent XSS

2.Non Persistent XSS

In order to demonstrate a XSS attack I will take an example of a website:

http://www.redwrappings.co.in

Checking the venerability

The simplest way to check the vulnerability is to enter the following code in the any web form present on the website

<script>alert(“XSS”)</script>

Once the attacker inserts the code A dialog box like the below one will appear:

Defacement

Now the attacker has found that the website is velnerable to an xss attack the attacker can do lots of damages to the website, The most common thing which the attacker will do is place his defacement image on that page showing that the website is hacked, For this purpose he will insert a code similar to the below one:

<html><body><IMG SRC=”http://site.com/yourDefaceIMAGE.png”></body></html>

Where http://site.com/yourDefaceIMAGE.png is the defacement image

Inserting Flash Videos

The attacker can also insert flash videos by entering the following code in any web form present on the website

Redirection

The attacker can also redirect the page to any particular page , In case if the hacker has managed to find XSS venerability in the a website like paypal.com or alertpay.com he can redirect that page to a Phisher Site(Fake login page) where the victim will loose his password, To redirect a an xssed page to another page the attacker will insert a code similar to the below one:

<script>window.open( “http://www.google.com/” )</script>

Stealing Cookies

Most of the attackers after finding a website venerable to xss will probably steal victims cookies to gain access to their account or private data this method is called Session hijacking, which is a detailed topic and I will be explaining in the later articles