XSS Attacks

The XSS Discovery Toolkit 9 Chapter 2 51

We mentioned that you can create scripts by clicking on Tools I GreaseMonkey I

Create

Script. Next, we will illustrate how you can dynamically create GreaseMonkey

scripts right from your browser.

Take the 'hello word' user script code and paste it into your favorite URL encoder (e.g.,

http://meyerweb.com/eric/tools/dencoder/).

Figure 2.37 provides an example.

Figure 2.37 Meyerweb URL Decoder/Encoder

Click on the encode button and add the following line in front of the generated string:

data: text/j avascript ; charset=utf-8,

At the end of string ...