The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Exploiting the Vulnerability

As you will see, XSS vulnerabilities can be exploited in many different ways to

attack other users of an application. One of the simplest attacks, and the one

that is most commonly envisaged to explain the potential significance of XSS

flaws, results in the attacker capturing the session token of an authenticated

user. Hijacking the user’s session gives the attacker access to all of the data and

functionality to which the user is authorized (see Chapter 7).

The steps involved in this attack are illustrated in Figure 12-3.

Figure 12-3:  The steps involved in a reflected XSS attack

Application 

1. User logs in 

3. User reque

sts attacker’

s URL 

4. Ser

ver responds w

ith  

attacker’

s JavaScript 

5. Attacker’s  

JavaScript  

executes in  

user’s browser 

2. Attacker feeds crafted URL to user 

6. User’s browser sends session token to attacker 

7. Attacker hijacks user’

s sess

ion 

User 

Attacker