The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Cross-Site Scripting

Cross-site scripting (or XSS) is the Godfather of attacks against other users. It

is by some measure the most prevalent web application vulnerability found in

the wild, afflicting literally the vast majority of live applications, including

some of the most security-critical applications on the Internet, such as those

used by online banks.

Opinions vary as to the seriousness of XSS vulnerabilities. Ask many a

hacker or professional pen tester, and they will tell you, “Cross-site scripting is

lame.” And in one sense it is. XSS vulnerabilities are often trivial to identify