XSS Attacks

248 Chapter 6 9 XSS Exploited

Figure

6.14 The textarea with the Results

Owning the Documents

As previously mentioned, the document's contents can just as easily be snarled. The script

would only have to have the target address changed to

documents.stp,

and the script would

have to be altered to parse out the documents URL's. It is important to note that only text-

based files can be obtained via this method. This includes

.html, .txt, .is,

and so on.

As this illustration proves, cross-site request forgery attacks are dangerous. In the case of

this program, a simple spoofed e-mail would