Javascript Alerts

I don’t understand what you’re asking about :) the javascript: directive or the document.cookie part?

Be aware that alerting cookies wont work if they have the HttpOnly flag set :)

Hi there,
I don’t know if you already know about OWASP, but they feature all major vulnerabilities. You are looking for “cross-site scripting” sometimes called CSS or more often XSS, so it doesn’t confuse with Cascading style sheets. Another term would be “session riding”.

Have a look here:
https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29

There are some examples there and there is also a cheat sheet how to prevent something like that from happening here:
https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet

Maybe wikipedia is a good start as well, but I guess OWASP covers it in more detail…

Have fun!

dit:
Since sabertooth mentions the alert() thing: Mostly the alert() is only to check if it is possible to inject arbitrary script code. The actual attack uses something like src-attribute of iframes or image-tags to send the victims cookie to your server. But if you have a look at the pages I posted above, there are some examples…

Thank you. Help with either directive or the document.cookie part would be appreciated.

It seems that XSS is so hot these days. Maybe I should take a look this way. ;)

@freewind1012 I’ve personally found the opposite :) Many browsers these days have xss protection and there are site headers which mostly mitagate the issue. Couple this with cookie flags like HttpOnly, and most common frameworks having inbuilt protection.
Of course it’ll never fully be wiped out, but more and more I think we’re seeing xss as an attack vector which is on the decline.

@sabretooth: Yeah, I have no argument about the technical side. The more people aware of this exploitation, the better it will get “treated”. The “hot” thing which I said, maybe, is relevant to HackThis!! levels. ;)

@freewind1012 Now it makes more sense ;)

For those wanting a quick XSS challenge (no registration), check this out by Google:
https://xss-game.appspot.com/

Thanks for all the info. Will keep the thread open for now