The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

382

Chapter 12 

■

Attacking Other Users

70779c12.qxd:WileyRed  9/14/07  3:14 PM  Page 382

---

If the attacker did not exploit the XSS vulnerability, but instead performed a

pure phishing attack by offering a link to his own malicious web server, many

less gullible users would suspect that it was a scam, and the attack would be

far less successful.

C O M M O N   M Y T H

“Phishing scams are a fact of life on the Internet, and I

can’t do anything about them. There is no point wasting time trying to fix the

XSS bugs in my application.”

Phishing attacks and XSS vulnerabilities are entirely different phenomena. Pure

phishing scams involve creating a clone of a target application and somehow