XSS Attacks

Advanced XSS Attack Vectors 9 Chapter 5 209

Figure 5.1 Example of an Exception Exploit in beyondsecurity.com

Because Flash has the ability to spoof HTTP headers (at least ones that are not already

set), the attacker has the ability to force a user through redirection to visit the page, while

sending the malicious header. In this way, the attacker can inject XSS into any vulnerable

instance of the Web server.This primarily affects versions of Apache prior to 1.3.35, 2.0.58,

and 2.2.2; however it may affect other variants.

This is a good lesson though. The attacker can leverage ...