3

I am trying to test a local website link for a possible XSS attack. Can you please help me looking for a solution in way that if i add some script tag to the end of the URL under test, then it either throw and exception or an alert. For Eg: If link under test is: https://testmysite/login.aspx then what kind of script I can append with URL so that it returns an Exception or an Alert. I hope that the question is clear. Pardon me if this has been already asked as I am unable to find the exact problem.

Improve this question

3 Answers 3

Reset to default
3

In addition to Joe's resource, the OWASP site has a lot on XSS too: https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29

I would also encourage you to look a bit further than OWASP once you get those base concepts down. There are MANY ways to bypass basic XSS protections.

Improve this answer
0
1

Check this out: http://www.acunetix.com/websitesecurity/cross-site-scripting/

Their example is:

<script type="text/javascript">
  alert('This is an XSS Vulnerability')
</script>
Improve this answer
5
  • 1
    Isn't that more for including in the body of a page? If you want to attack he URL don't you need ones that take parameters, in which case his example won't be susceptible to it?
    – Phil Kirkham
    Sep 10, 2013 at 20:11
  • 1
    I agree. His example doesn't actually lend itself to this vulnerability. But I think his was a made-up example, without an understanding of the issue. Hopefully the link will clear that up.
    – Joe Strazzere
    Sep 11, 2013 at 11:09
  • Thanks for the answers guys and link is worth but when i tried to put my site inside the script then the page stays as it is. For eg. if i am on login page then if i try to append the script then page don't display any alert or exception. Is it fine ? How do we get to know that the page has been attacked ?
    – ChhabraSaab
    Sep 11, 2013 at 15:15
  • 2
    Seems you need do a LOT more reading - the example Joe gave is for a site where part of the page is made up from user input e.g. a comment, if there is an exploit then a msg box will appear. Please read the link Joe gave
    – Phil Kirkham
    Sep 11, 2013 at 19:09
  • Sure Phil. I'll get back in case of issues. Thanks
    – ChhabraSaab
    Sep 12, 2013 at 4:02
0

Check this out, I've shared an article on XSS attack and cheat sheet for scripts - http://www.cygnet-infotech.com/is-your-website-safe-against-cross-site-scripting-attacks

Improve this answer
1
  • 1
    This is not an answer to the question - it's basically spam for your website.
    – Kate Paulk ♦
    May 30, 2014 at 13:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.