Excess-xss.com Website Review

Cross-site scripting (XSS) is a code injection attack that allows an attacker to execute malicious Ja*aScript in another user's browser. The attacker does not directly target his victim. Instead, he exploits a vulnerability in a website that the victim visits, in order to get the website to deliver the malicious Ja*aScript for him. To the victim's browser, the malicious Ja*aScript appears to be a legitimate part of the website, and the website has thus acted as an unintentional accomplice to the attacker. The only way for the attacker to run his malicious Ja*aScript in the victim's browser is to inject it into one of the pages that the victim do*nloads from the website. This can happen if the website directly includes user input in its pages, because the attacker can then insert a string that will be treated as code by the victim's browser. In the example below, a simple server-side script is used to display the latest comment on a website: The script as*umes that a comment consists only of text. However, since the user input is included directly, an attacker could submit When the user's browser loads the page, it will execute whatever Ja*aScript code is contained inside the