Let us start with excesses, that is cross site scripting in this video, we will have an overview to
what is cross site scripting, crosschecks scripting attacks, exposed vulnerabilities in dynamically
generated Web pages, which enables malicious attackers to injure clients script into Web pages viewed
by other users.
Attackers inject malicious JavaScript, VB script Actimel or Flash and many more for execution on victim
system by hiding it within legitimate requests.
Many Web applications and websites are still vulnerable to these security threats.
Crossette scripting is one of the most common application.
There will be attacks, exs vulnerabilities, target scripts embedded in a page that are executed on
the client side rather than on the server side.
Exercice in itself is a threat that is brought about by the internal security weaknesses of the client
side scripting languages such as JavaScript, A.T.M..
The concept of exercise is to manipulate clients Allscripts of the web application to execute in the
manner desired by the malicious user.
Such a manipulation can embed a script in a page that can be executed everytime the page is loaded or
whenever an associated event is performed.
From the image on the screen, you can see that the attacker has injected a malicious script into that
login form.
And when the user types his username and password, all the details in the login from the list, the
username and password will be fetched by the attacker.
So how does X's works?
There are many ways in which an attacker can entice a victim into initiating reflect two X's request.
For example, the attacker could send the victim a misleading email with a link containing malicious
JavaScript if the victim clicks on the link.
The HTP request was initiated from the victim's browser and sent to the vulnerable application.
The malicious JavaScript is then deflected back to the victim's browser were executed in the context
of the victim's user session by exploiting the ex's vulnerabilities and attacker can perform malicious
actions, such as hijacking an account, spreading web firms, accessing browser history and Kliper
contents, controlling the browser remotely scanning and exploiting the Internet or Internet appliances
and applications.
So what connections do exist can impersonate or masquerade the victim user to carry out any action that
the user is able to perform.
Indeed, any data that the user is able to access capture the user's login credentials.
But from what you defacement of the website and finally in the Crutzen functionality into the website,
in the next lecture we will see types of exercice.