The cross-site scripting Attack (Cross-site Scripting) is a security vulnerability of a Web site application and is one of the code injection attacks. Types of XSS: Reflective XSS:
- Non-persistent XSS (requires self-triggering, input-output). It is "reflected" from the target server by means of error messages, search results, and so on.
- Non-persistent: This type of attack is often only one-time.
- Way: The attacker sends a malicious link containing the injected script to the victim by mail, and the victim clicks on the link, the injected script is routed to the target server, and the server "bounces" the script into the victim's browser to execute the script on that browser.
- Eg:http://www.baidu.com?input=<script>alert (Document.cookie) </script>
Storage-Type XSS:
- Persistent XSS (input-Save to database-output)
- By entering the script to the database, when others see the content, it will be malicious attacks, the victim's information or other, sent to the attacker's server.
DOM-XSS:
- dom-based XSS Vulnerability is a vulnerability to the Document object model, which involves two levels, HTML layers, and JavaScript layers, more precisely server scripts and client script.
- The user requested a URL that was designed by the attacker, which contained embedded JavaScript, and the attacker could use a script to obtain a user cookie
Fishing:
- Scam users enter sensitive information to send sensitive information such as user name, password, etc. to the attacker.
Cross-site Request forgery:
- Cross-siterequest forgery CSRF, which is a derivative of XSS, is the way that the script forges the victim to send a legitimate request
Inject malicious software:
- With XSS attacks, attackers can introduce malicious software into scripts such as "viruses", "Trojans", "worms" and so on,
How to deal with the above attacks:
- For reflective XSS as well as some Dom XSS, the general recommendation is to develop some automated tools for scanning, supplemented by manual analysis, on the other hand can be found using search engines, the specific white hat.
- For storage types: Many are initiated using the Rich Text editor, so it is recommended to use ANTIXSS similar class libraries for input filtering.
Comprehensive network technical articles, if there are errors, please correct me, thank you very much!
Principle of XSS
