Topic: SECURITY - on December 19, 2011 at 1:01:00 PM CET
'XSS on steroids' crafted to highlight web security holes
A hacker has published code for potent cross-site scripting attacks that he claims go beyond the usual cookie stealing and phishing for users' private details.
Cross-site scripting (XSS) flaws allow attackers to present content under their control in the context of a vulnerable yet trusted site, thus tricking marks into handing sensitive information to miscreants. As well as creating a means to present pop-ups that link to a hacker-controlled site, XSSes can also lead to cookie theft.
Niklas Femerstrand is the hacker who in October 2011 discovered that a debugging tool on the American Express website was vulnerable to an XSS flaw. He developed an "XSS on steroids" script while researching a similar flaw on the website of an unnamed Swedish bank.
... Comment
