If I am taking data from a website, for example status updates from Facebook and showing them on my website. What possible damage can be caused if I am not taking into account that the code written as status update would execute on my website?

For example, Mr. Simon has putted his status update,

"<p style="color:red;">I love to code</p>"

Now, when I display this on my website, it transforms into the text I love to code written in red.

  • 2
    Is you question just "What damage can an xss vulnerability cause?"? – CodesInChaos Mar 2 '13 at 11:12

Basically you will be vulnerable to XSS - the element might as well be a script element or the paragraph element could have an onmouseover etc attributes to run a script.

  • If you are not using HttpOnly session cookies, XSS can be used to steal sessions.
  • All security measures against CSRF are useless if you are vulnerable to XSS.
  • The script can dynamically load malicious java, flash, pdf etc plugin files, which can exploit bugs in the respective browser plugins.
  • The script can redirect the user somewhere else, hide your page or make for a convincing phishing page since it's on your domain.
  • Probably many more - only your imagination is the limit :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.