The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

C O M M O N   M Y T H

“We’re not worried about that low-risk XSS bug — a user

could only exploit it to attack themselves.”

As the example illustrates, even apparently low-risk vulnerabilities can in the

right circumstances pave the way for a devastating attack. Taking a defense-

in-depth approach to security entails removing every known vulnerability,

however insignificant it may seem. Always assume that an attacker will be

more imaginative than you in devising ways to exploit minor bugs!

Payloads for XSS Attacks

So far, we have focused on the classic XSS attack payload, which is to capture

a victim’s session token, hijack their session, and thereby make use of the

application “as” the victim, performing arbitrary actions and potentially tak-

ing ownership of that user’s account. In fact, there are numerous other attack

payloads that may be delivered via any type of XSS vulnerability.