Think
about what actions could be malicious from the victim??™s computer within the victim??™s
intranet.
To mimic the user, the attacker needs to figure out how the web application works.
Sometimes, you can do so by reading the page source, but the best method is to use a
web proxy like Burp Suite, WebScarab, or Paros Proxy. These web proxies intercept all
traffic to and from the web browser and web server??”even over HTTPS. You can record
sessions to identify how the web application communicates back to the server. This helps
you understand how to mimic the application. Also, web proxies are great for finding
XSS and other web application vulnerabilities.
XSS Worms
Networking web applications, such as webmail, social networks, chatrooms, online
multi-player games, online casinos, or anything that requires user interaction and sends
some form of information from one user to another, are prone to XSS worms. An XSS
worm takes advantage of existing features in the web application to spread itself. For
example, XSS worms in webmail applications take advantage of the fact that an attacker
can grab the victim??™s contact list and send e-mails. The XSS would activate when a victim
clicks a link leading to the HTML injection, thus triggering the script to execute.
Pages:
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126