Category Archives: Cross Site Scripting

This section is for posts related to Cross Site Scripting (XSS)

Hacme Books Week 4

Posted on December 17, 2012 by

This is the fourth in a series of five posts for the vulnerable web application Hacme Books. New posts for Hacme Books will post every Monday. Cross Site Scripting Attacks A Cross Site Scripting attack is most commonly used for … Continue reading →

Posted in Cross Site Scripting, Cryptographic Attacks | Tagged , | Leave a comment

WebGoat Week 9

Posted on September 17, 2012 by

This is the ninth in a series of ten posts for the OWSAP WebGoat vulnerable web application. New posts for WebGoat will post every Monday. Exploit Unchecked Email This lesson has two steps: first you are to send a malicious … Continue reading →

Posted in Bypass Client Side Validation, Client-Side Attacks, Cross Site Scripting, Session Hijacking, Spoofing Cookies | Tagged , , | Leave a comment

WebGoat Week 6

Posted on August 27, 2012 by

This is the sixth in a series of ten posts for the OWSAP WebGoat vulnerable web application. New posts for WebGoat will post every Monday. Concurrency Thread Safety Problems First things first, you will need two separate browsers to do … Continue reading →

Posted in Cross Site Request Forgery, Cross Site Scripting, Reflected XSS, Stored XSS, Thread Safety Problems | Tagged , , | Leave a comment

WebGoat Week 2

Posted on July 30, 2012 by

This is the second in a series of ten posts for the OWSAP WebGoat vulnerable web application. New posts for WebGoat will post every Monday. LAB: Role Based Access Control Scheme Bypass Business Layer Access Control For this lab you … Continue reading →

Posted in Access Control Flaws, Cross Site Scripting, Data Layer Access Control, DOM Based XSS, Remote Admin Attacks | Tagged , | Leave a comment

WAVSEP – Web Application Vulnerability Scanner Evaluation Project

Posted on September 19, 2011 by

I have to admit that I really think this is a good idea. Shay Chen (@sectooladdict) has put together a project to evaluate Web Application Vulnerability scanners. He calls it WAVSEP. The project is currently being hosted on Google code. … Continue reading →

Posted in Cross Site Scripting, SQL Injection | Tagged , , , | Leave a comment

Cross Site Scripting – So what?

Posted on September 12, 2011 by

Ok – so I decided to put in a few things about Cross Site Scripting. I wanted to give you enough information to be able to both understand XSS, and more importantly do it against a modern application protected by … Continue reading →

Posted in Cross Site Scripting | Tagged , , , | Leave a comment