XSS Attacks

348 Chapter 7 9 Exploit Frameworks

Figure 7.35 XSS-Proxy Setup Defaults

This works fine if the attacker and victim are on same host, but real-world attacks will

need to change the IP/URL for the

$code_server

variable to match what will be passed in the

XSS vector for a remote JavaScript server.You can also change the listener port for XSS-

Proxy by changing the

$serverport

variable.

$init__dir

can be set to specific directories if a

target Web server if finicky about a starting directory or we have a specific location we want

the victim to initially load. Our attack server ...