1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head>
<title>Cross-Site Scripting Resources</title>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<link href="designstyle.css" type="text/css" rel="stylesheet">
<style type="text/css">
<!--
ol.bluelist li {
color: #3366ff;
font-family: sans-serif;
}
ol.bluelist li p {
color: #000;
font-family: "Times Roman", times, serif;
}
ul.blacklist li {
color: #000;
font-family: "Times Roman", times, serif;
}
//-->
</style>
</head>
<body>
<h1> <a name="XSS_Resources"></a>Cross-Site Scripting Resources</h1>
<center><strong>Status: Current</strong>
<small>(as of 17 August 2006)</small></center>
<br>
<p>Cross-Site Scripting (commonly abbreviated as XSS) is a security
issue that arises when an attacker can cause client-side script (such as
JavaScript) of his or her choosing to execute within another user's
browser in the context of a given web-site or web-application. This may
allow the attacker to steal that user's session cookies for the
web-application in question, or otherwise manipulate that user's session
context.
<p>XSS vulnerabilities most often arise if a web-application renders
data that originated from an untrusted source (such as a query
parameter) in a HTML document without carefully validating or escaping
that data.
<p>The following online resources provide further information on XSS
vulnerabilities and how to avoid them:
<ul>
<li>The Open Web Application Security Project (OWASP) has an
<a
href="http://www.owasp.org/index.php/Cross_Site_Scripting">introductory
article</a> on XSS.
</li>
<li>In addition, the OWASP's <a
href="http://www.owasp.org/index.php/Category:OWASP_Guide_Project">Guide to Building Secure Web
Applications and Web Services</a> and the <a
href="http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project">"Top
Ten" Vulnerabilities</a> include sections on XSS.
</li>
<li>The CERT Coordination Center published <a
href="http://www.cert.org/tech_tips/malicious_code_mitigation.html">Understanding
Malicious Content Mitigation for Web Developers</a> and <a
href="http://www.cert.org/advisories/CA-2000-02.html">Advisory
CA-2000-02 Malicious HTML Tags Embedded in Client Web Requests</a>.
</li>
</ul>
</body>
</html>
|