XSS

Hello all,

Being new to XSS and seing alot of messages in the last couple weeks on the subject got me wondering...

What is the real vulnerability if the site in questions is vulnerable to XSS but does not let you write any malicious scripts on the system, like message board, forums etc... ? Can anything be done to exploit XSS if the above scenario occurs ? I know it depends on the web server, packages installed etc... I'm asking in generaly is it possible ?

You can do the document.cookie and view your cookie, that migth give a hint on the structure but... or redirect yourself to another web site :) etc...

I've read the document on XSS by David Endler http://www.idefense.com/papers.html but still have some questions.  

If possible, can the XSS guru's on the list shed some light on the subject.

Thanks for your time,

Cheers

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek