Process use reflective XSS
1. The malicious attacker to send a victim a link (link carries xss Code)
2. attacker to convince a victim points to open this link
3. XSS code is submitted to the Web application has XSS vulnerabilities
4. WEB application data is not filtered is submitted, or the filter is not critical.
5. WEB application output data submitted by the user up (XSS comprising code).
6. The user's browser rendered HTML page returned, execution returns JavaScript code
7. malicious javascript code quietly in the background, obtaining user information
Type process using the stored XSS
1. The malicious attacker to make your site XSS vulnerabilities exist in the code submitted XSS period
2. Web application accepts data submitted, no filter or filters are not strictly
3. Write to the database
4. The existence of XSS victims access the malicious code page
5. Web application reads data submitted prior to the malicious attackers from the database
6. Web application server returns this data
7. The victim returned browser rendering HTML pages, execute JavaScript code is returned
8. malicious javascript code quietly in the background, obtaining user information
