| Directory > Computers > Security > Internet > WWW > Cross Site Scripting Cross Site Scripting Vulnerabilities
Security consultant David deVitry offers background information, a free CSS vulnerability detector,
and a list of vulnerable sites.
http://www.devitry.com/security.html
Reviews Rating: Not yet Rated
Whois Check
CNN.com: Schwab's Site Could be Vulnerable
Charles Schwab's online customers are at risk of having their account information accessed and
their accounts manipulated due to the same software vulnerability that affected E-Trade's Web site
in September.
http://www.cnn.com/2000/TECH/computing/12/08/schwab.cost.idg/
Reviews Rating: Not yet Rated
Whois Check
Bypassing Javascript Filters - The Flash Attack
Paper by EyeonSecurity explaining how to inject CSS attacks into Web applications which allow Flash
content.
http://eyeonsecurity.net/papers/flash-xss-description.htm
Reviews Rating: Not yet Rated
Whois Check
Information on Cross-Site Scripting Security Vulnerability
Microsoft Technet provides a FAQ, overview of the threats posed by XSS, and suggestions for how
their customers can protect themselves.
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/topics/crssite.asp
Reviews Rating: Not yet Rated
Whois Check
WhiteHat Community: Cross-Site-Scripting
Several articles on the subject.
http://community.whitehatsec.com/search.pl?topic=Cross-Site-Scripting
Reviews Rating: Not yet Rated
Whois Check
iDefense iALERT White Paper: Evolution of Cross-Site Scripting Attacks
Predicts semi-automated techniques will aggressively begin to emerge for targeting and hijacking
web applications.
http://www.idefense.com/XSS.html
Reviews Rating: Not yet Rated
Whois Check
SkyLined: Cross-site scripting
Bad user-input filtering can lead to SQL- and HTML-injection, Cross-site scripting and server-side
script DoS. Includes guide to finding flaws and an archive of flaws found in popular web sites.
http://spoor12.edup.tudelft.nl/SkyLined/docs/bad_user_input_filtering.html
Reviews Rating: Not yet Rated
Whois Check
InfoWorld Opinions: Cross-site Scripting
Article on this often overlooked threat with links.
http://www.infoworld.com/articles/op/xml/02/05/06/020506opsecurity.xml
Reviews Rating: Not yet Rated
Whois Check
Microsoft Security Bulletin (MS00-060)
Patch available for 'IIS Cross-Site Scripting' vulnerabilities.
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms00-060.asp
Reviews Rating: Not yet Rated
Whois Check
Apache: Cross Site Scripting Info
How the attack affects websites hosted on the Apache webserver and Apache specific issues.
http://httpd.apache.org/info/css-security/
Reviews Rating: Not yet Rated
Whois Check
CERT/CC: How To Remove Meta-characters From User-Supplied Data In CGI Scripts
Examples in C and Perl.
http://www.cert.org/tech_tips/cgi_metacharacters.html
Reviews Rating: Not yet Rated
Whois Check
CERT Advisory CA-2000-02: Malicious HTML Tags Embedded in Client Web Requests
Advisory published jointly by the CERT Coordination Center, DoD-CERT, the DoD Joint Task Force for
Computer Network Defense (JTF-CND), the Federal Computer Incident Response Capability (FedCIRC),
and the National Infrastructure Protection Center (NIPC).
http://www.cert.org/advisories/CA-2000-02.html
Reviews Rating: Not yet Rated
Whois Check
perl.com: Preventing Cross-site Scripting Attacks
Paul Lindner, author of the mod_perl cookbook, explains how to secure our sites against Cross-Site
Scripting attacks using mod_perl and Apache::TaintRequest.
http://www.perl.com/pub/a/2002/02/20/css.html
Reviews Rating: Not yet Rated
Whois Check
'Cross-site scripting' tears holes in Net security
USA Today article by Byron Acohido that details WhiteHat Security's assesment of Hotmail, Yahoo,
Amazon, and America Online.
http://www.usatoday.com/life/cyber/tech/2001-08-31-hotmail-security-side.htm
Reviews Rating: Not yet Rated
Whois Check
The Cross Site Scripting FAQ
Answers questions on identification, threats, and prevention. Provides examples and links.
http://www.cgisecurity.com/articles/xss-faq.shtml
Reviews Rating: Not yet Rated
Whois Check
|
