|
|
Security Watch: Squatters Jumping Claims To Domain NamesDATE: 24-JUL-2006 Cross-Site Scripting AttacksSeveral security researchers have been focusing in the last few weeks on "Cross-Site Scripting" vulnerabilities in various Web sites. A Russian research site has just revealed one of many in the PayPal site.Consider this link:This is a link to the PayPal site, and a cursory examination of it, from left to right, will reveal it to be such.But the link includes scripting instructions that redirect the page to a different site, in this case PCMag.com. This attack realizes more malicious potential when it is run in a frameset where the URL continues to display the paypal.com address but the window contains some other site's HTML.Many security tools, including the Netcraft Toolbar, generically identify attacks such as these as cross-site scripting attacks. You can also identify many of them just by being more alert to URL contents and windows.
|
|
|
Data Protection Virtual Tradeshow
Available On-Demand
Join Cameron Crotty and experts as they explore best practices and solutions needed to maintain a secure flow of data.
|
|
|
