Web site Common Vulnerability resolution: XSS attack

Cross-station attacks, that is, cross site Script Execution (usually abbreviated as XSS, because CSS is the same name as cascading style sheets, and therefore XSS) refers to an attacker using a Web site program to filter user input, and enter HTML code that can be displayed on the page to affect other users. Thereby stealing user information, using the identity of a user to carry out some kind of action or to the visitor to carry out a virus attack way. Many people's use of XSS is mostly in the frame, and some vendors disagree with XSS, and they think the security level is low or even negligible.

General steps for cross-site attacks:

1. After the attacker has determined the target, write the attack code where the target site can write to the database

2. Web site managers in the Browse attack code is its own information leakage

3. Malicious code returns the retrieved information to the attacker

4. Attackers invade targets based on acquired information

XSS Vulnerability Exploits

One, stealing cookies

For a cross-site attack, the most common use is cookie theft, which can be modified to obtain cookies directly by using the "Ming Boy" tool or other browser that modifies cookies (such as Firefox with a cookie edit plugin). This allows you to gain administrative access to the Web site.