XSS Attacks

Advanced XSS Attack Vectors

,,

Chapter 5 217

[] An attacker can use the MHTML vulnerability to read across domains.

[] The MHTML vulnerability is limited in use to the first double line break after the

HTTP header. After that point, MHTML can read the text. If there are no double

line breaks in the code, the MHTML vulnerability cannot read from the remote

page.

[] An attacker must know the UILL they intend to read from. If it contains a nonce,

the attacker must know the nonce to read from the page.

Hacking JSON

[] JSON can serialize objects into anonymous arrays.

[] If the object is serialized and does not