Using XSS to steal access

Ben Jeavons — Mon, 31 Jan 2011 19:00:09 +0000

We've talked about Cross Site Scripting (XSS) before, and for good reason, it's a risk far too many sites are vulnerable to. XSS is scary because it runs in the context of the trusted relationship between your browser and a website; XSS can do everything you can do.

XSS cookie theft

Let's look at another example of an XSS exploit: stealing administrative access to a site.

An attacker will enter Javascript that steals the visitor's browser cookie
An administrator will unknowingly execute this Javascript
The administrator's browser will send the cookie to the attacker's website
The attacker will use the stolen cookie to use the administrator's access on the site

This article is now part of the Knowledge Base of Drupal security articles on Drupal Scout.

Read the rest of Using XSS to steal access

This page is kept so the comments posted here are available since they provide additional help and insights.

Cracking Drupal - demo

Using XSS to steal access

XSS cookie theft