News - Main Page
Whitepapers
Tools and Download
Presentations

download

How to Detect and Exploit 99% of XSS Vulnerabilities

This presentation has given in Intercon 2007 (Portcullis's internal conference), Talks about exploiting and identifying most common XSS vulnerabilities in real world.

Examples include following types,

  • Classic XSS Vulnerabilities
  • In HTML Attributes
  • In Comments
  • In Javascript Blocks
  • DOM Based XSS
  • Flash Based XSS
  • Direct Linking

Presentation was heavily based on demonstration, so you need to fill in the blanks.

Last Updated : 02/04/2008 16:23:40


Related Applications

  • BSQL brute forcer V2Updated version of the Blind SQL Injection Brute Forcer from www.514.es. Works against PostgreSQL, MySQL, MSSQL and Oracle and supports custom SQL Queries.
  • BSQL HackerBSQL (Blind SQL) Hacker is an automated SQL Injection Framework / Tool designed to exploit SQL injection vulnerabilities virtually in any database.
  • DoS Attacks Using SQL WildcardsThis paper discusses abusing Microsoft SQL Query wildcards to consume CPU in database servers. This can be achieved using only the search field present in most common web applications.
  • Flash Security
  • hoppyHTTP options prober and information disclosure scanner
  • Insecure Trends in Web 2.0 Applications
  • XSS ShellXSS Shell is a powerful XSS backdoor, in XSS Shell one can interactively send requests and get responses from victim and it allows you to keep the control of session

Related Whitepapers