Comments on: The Cross Site Scripting FAQ http://blog.sonufifu.com/seo/the-cross-site-scripting-faq/ sonufifu Wed, 19 Nov 2008 23:19:57 +0000 http://wordpress.org/?v=2.0.3 by: Search Engine Optimization (SEO) Journal » Blog Archive » Proof of Concept http://blog.sonufifu.com/seo/the-cross-site-scripting-faq/#comment-5 Fri, 07 Jul 2006 19:16:55 +0000 http://blog.sonufifu.com/seo/the-cross-site-scripting-faq/#comment-5 [...] I’ve actually noticed the same thing myself. One of the hardest parts of XSS is locating what is and isn’t valid XSS. Some things can include HTML injection but there is no way to reasonably exploit the vulnerability. Does that make it less scary? Yes! The reason XSS is scary is because it can lead to information disclosure, but if there is no way to get another user to see the HTML you injected, then it’s not a real vulnerability. Sloppy coding? Yes. Vulnerability? No. [...] […] I’ve actually noticed the same thing myself. One of the hardest parts of XSS is locating what is and isn’t valid XSS. Some things can include HTML injection but there is no way to reasonably exploit the vulnerability. Does that make it less scary? Yes! The reason XSS is scary is because it can lead to information disclosure, but if there is no way to get another user to see the HTML you injected, then it’s not a real vulnerability. Sloppy coding? Yes. Vulnerability? No. […]

]]> by: ha.ckers.org web application security lab - Archive » Proof of Concept http://blog.sonufifu.com/seo/the-cross-site-scripting-faq/#comment-4 Tue, 04 Jul 2006 18:17:30 +0000 http://blog.sonufifu.com/seo/the-cross-site-scripting-faq/#comment-4 [...] I’ve actually noticed the same thing myself. One of the hardest parts of XSS is locating what is and isn’t valid XSS. Some things can include HTML injection but there is no way to reasonably exploit the vulnerability. Does that make it less scary? Yes! The reason XSS is scary is because it can lead to information disclosure, but if there is no way to get another user to see the HTML you injected, then it’s not a real vulnerability. Sloppy coding? Yes. Vulnerability? No. [...] […] I’ve actually noticed the same thing myself. One of the hardest parts of XSS is locating what is and isn’t valid XSS. Some things can include HTML injection but there is no way to reasonably exploit the vulnerability. Does that make it less scary? Yes! The reason XSS is scary is because it can lead to information disclosure, but if there is no way to get another user to see the HTML you injected, then it’s not a real vulnerability. Sloppy coding? Yes. Vulnerability? No. […]

]]>