1, six months for those who did not update small business Web site, XSS vulnerabilities occur with little
2, but in all kinds of social platforms, mail system, open popular Web applications, BBS, microblogging scene, causing lethal but very powerful.
3, the user cookie hijacking is the most common form of cross-site attacks, by writing and executing scripts executable file in a Web page (a JavaScript script code in most cases), hijack the user's browser, sessionID information will be sent to the user is currently using attack site-controlled or server.
4, can be called "the framework of fishing." One of the basic functions using the JS script: DOM tree structure and contents of the operation page, page by JS script to generate a false page to deceive users perform the operation, and all the contents of the user's input will be sent to the attacker's server on.
5, linked to horse (puddle attack)
6, there are limitations keyloggers
