XSS - Cross Site Scripting Cheat Sheet By Ishan
Note for you people: XSS is Cross Site Scripting. If you don't know how XSS (Cross Site Scripting) works, this page probably won't help you. This page is for people who already understand the basics of XSS attacks but want a deep understanding of the nuances regarding filter evasion. This page will also not show you how to mitigate XSS vectors or how to write the actual cookie/credential stealing/replay/session riding portion of the attack. It will simply show the underlying methodology and you can infer the rest. Also, please note my XSS page has been replicated by the OWASP 2.0 Guide in the Appendix section. However, because this is a living document I suggest you continue to use this site to stay up to date.Also, please note that most of these cross site scripting vectors have been tested in the browsers listed at the bottom of the page, however, if you have specific concerns about outdated or obscure versions please download them from Evolt. Please see the XML format of the XSS Cheat Sheet if you intend to use CAL9000 or other automated tools. If you have an RSS reader feel free to subscribe to the Web Application Security RSS feed below, or join the forum:Click here for XSS (Cross Site Scripting) CHEAT SHEET
XSS Cheat Sheet by Valentin
Here you find my custom XSS and CSRF cheat sheet. I know that there are many good cheat sheets out there, but since some of them are offline from time to time, I decided to create a little collection of useful XSS stuff. I added some stuff from other well known cheat sheets (e.g. from http://ha.ckers.org/xss.html) , please scroll down to see a complete list of sources.There XSS codes can be used to test your own website for XSS/CSRF vulnerabilities. Some of them even can be used to bypass various XSS/CSRF filters. I did not include any details or explanations since I assume you are experienced with this type of vulnerability and know what you are doing.
No comments:
Post a Comment