The scene is important.

1.6 scenes are important.

Often hear someone say: "XSS is not harmful, very few people to pay attention to." "In fact, the person who said this may have omitted the context, for example, for those small business sites that do not update for half a year, there is little use for XSS vulnerabilities."

Hanging a horse? Almost never happens, who would use XSS to lure a horse to a site without influence?

Stealing administrator cookies? Six months does not update the site, this probability is very low.

If someone really went to the apt (persistent threat) attack, just stare at this site for half a year, an XSS steals cookies to use first half a year, the administrator may not be lured to view this XSS link, even if viewed, if it is a reflective xss,ie 8/ie 9/ Chome directly to intercept. Let's see ... Can we say how much this XSS is harmful? Harm can be almost ignored. But so spread, wildfire, a lot of people are beginning to feel that XSS is chicken ribs, the conclusion is more and more irresponsible, in their eyes only that kind of ms08-067 remote operating system privileges of the systematic level of vulnerability is kingly, we do not deny that this is very handsome, but the front-end hacker attack object is Web application, is not an operating system and is not inherently comparable. In many scenarios, the front-end attack of XSS, etc. is kingly.

For example, in all kinds of SNS, mail system, open source popular Web application scenarios, front-end attacks are widely implemented and concerned. No attack can be separated from the specific scene, about a lot of wonderful use, you will see in this book.

1.7 Summary

By reading this chapter, you should be able to understand that security research can have a big starting point, most of which are generic and not limited to web security. Understanding the key points of security, readers of our follow-up research is more analogy, we hope to teach the fishing, rigorous treatment of each safety point.

Start hacking into the content of our Web front-end hackers!