About XSS:
XSS (Cross Site Scripting), and in order not to Cascading Style Sheets abbreviation (Cascading Style Sheets) confusion, the cross-site scripting attacks abbreviated changed to XSS. XSS is a security exploit technology for web applications, code injection is a malicious attacker to insert malicious script in the web page code when a user visits the page, the embedded script code will be executed, so the purpose of malicious users. After the successful attack, a malicious user could get a higher authority, a variety of content privacy page content, session and cookie so on.
XSS attacks Category:
1. reflective XSS
reflective XSS type, also known as non-persistent XSS, such attacks often have disposable.
Attack: An attacker will send contain XSS code via e-mail, etc. malicious link to the target user. When the user accesses the link, the target server receives a user request and processed, then the server sends the data to the target code XSS with the user's browser, this browser parses malicious script code with XSS, it It will trigger XSS vulnerabilities.
2. The storage type XSS
storage type, also known as persistent XSS type XSS, attacks script will be permanently stored in a database or file of the target server with high covert.
Attack: This attack is more common in forums, blog and message boards. In the process of posting the attacker, the malicious script injected together along with the normal information content of the post, as the post is stored in the server down, the malicious script can also be permanently stored in the back-end storage server. When users browse the other was injected with a malicious script posts, malicious script will be executed in their browser.
3. DOM-type XSS
DOM stands for Document Object Model, DOM XSS type is actually a special type of reflective XSS, it is based on a model of vulnerability DOM document, using the DOM allows programs and scripts to dynamically access and update documents content, structure and style.
Attack: After a user requests a url specially designed, it is submitted by an attacker, and it contains XSS code response from the server does not contain the attacker's script in any form. When a user's browser handles the response, DOM XSS code for the object will be processed, resulting in the presence of XSS vulnerabilities.
