'Cross-site scripting' tears holes in Net security - http://www.usatoday.com/tech/news/2001-08-31-hotmail-security-side.htm
USA Today article by Byron Acohido that details WhiteHat Security's assessment of Hotmail, Yahoo, Amazon, and America Online. |
Apache: Cross Site Scripting Info - http://httpd.apache.org/info/css-security/
How the attack affects websites hosted on the Apache webserver and Apache specific issues. |
Bypassing Javascript Filters - The Flash Attack - http://eyeonsecurity.org/papers/flash-xss-description.htm
Paper by EyeonSecurity explaining how to inject CSS attacks into Web applications which allow Flash content. |
CERT Advisory CA-2000-02: Malicious HTML Tags Embedded in Client Web Requests - http://www.cert.org/advisories/CA-2000-02.html
Advisory published jointly by the CERT Coordination Center, DoD-CERT, the DoD Joint Task Force for Computer Network Defense (JTF-CND), the Federal Computer Incident Response Capability (FedCIRC), and the National Infrastructure Protection Center (NIPC). |
CNN.com: Schwab's Site Could be Vulnerable - http://www.cnn.com/2000/TECH/computing/12/08/schwab.cost.idg/
Charles Schwab's online customers are at risk of having their account information accessed and their accounts manipulated due to the same software vulnerability that affected E-Trade's Web site in September. |
Cross Site Scripting Vulnerabilities - http://www.devitry.com/security.html
Security consultant David deVitry offers background information, a free CSS vulnerability detector, and a list of vulnerable sites. |
InfoWorld Opinions: Cross-site Scripting - http://www.infoworld.com/article/02/05/03/020506opsecurity_1.html
Article on this often overlooked threat with links. |
perl.com: Preventing Cross-site Scripting Attacks - http://www.perl.com/pub/a/2002/02/20/css.html
Paul Lindner, author of the mod_perl cookbook, explains how to secure our sites against Cross-Site Scripting attacks using mod_perl and Apache::TaintRequest. |
The Cross Site Scripting FAQ - http://www.cgisecurity.com/articles/xss-faq.shtml
Answers questions on identification, threats, and prevention. Provides examples and links. |