Technique
technique:cross_site_scripting
Also: CSS-tag JavaScript execution, XSS
Web attack technique identified by FC as a flaw used during internet-based bank assessments.
Executing attacker-controlled JavaScript in the browser context of users viewing a profile.
“I found a way to execute JavaScript within a CSS tag”
“he could get whoever visited his profile to execute the JavaScript code”
Web attack technique identified by FC as a flaw used during internet-based bank assessments.
“A lot of cross-site scripting, a lot of SQL injection”
Web attack technique practiced by ETA members.
“cross-site scripting”
Web attack technique tested during the hospital penetration assessment.
“vulnerable to cross-site scripting attacks”
Web attack technique that Hieu says he used against data brokers.
“the third one, cross-site scripting”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | USES | Samy worm | Derived | 61 |
| incoming | USES | Samy Kamkar | Explicit | 61 |
| incoming | USES | Cygenta | Explicit | 66 |
| incoming | USES | Electronik Tribulation Army | Explicit | 70 |
| incoming | USES | Ed Skoudis | Derived | 121 |
| incoming | USES | Hieu Minh Ngo | Explicit | 162 |
Samy worm USES cross-site scripting
The worm propagated by causing profile visitors' browsers to execute JavaScript through a MySpace profile injection.
Derived Confidence 96% · Jack Rhysider EP 61 Details
“the code to add Samy as a friend was copied to that person’s profile”
Samy Kamkar USES cross-site scripting
Samy found a way to execute JavaScript within a CSS tag on MySpace profiles.
Explicit Confidence 99% · Samy Kamkar EP 61 Details
“I found a way to execute JavaScript within a CSS tag”
Cygenta USES cross-site scripting
FC says cross-site scripting is among the techniques used to get into banks over the internet.
Explicit Confidence 94% · FC EP 66 Details
“A lot of cross-site scripting”
Electronik Tribulation Army USES cross-site scripting
Ghost Exodus says ETA initially practiced cross-site scripting.
Explicit Confidence 98% · Jack Rhysider EP 70 Details
“and cross-site scripting”
Ed Skoudis USES cross-site scripting
Jack says Ed's team tested websites for cross-site scripting vulnerabilities.
Derived Confidence 94% · Jack Rhysider EP 121 Details
“see if those websites were vulnerable to cross-site scripting attacks”
Hieu Minh Ngo USES cross-site scripting
Hieu says he used cross-site scripting when attacking the data brokers.
Explicit Confidence 99% · Hieu Minh Ngo EP 162 Details
“and the third one, cross-site scripting”