I am little confused about this matter. By simply writing a JavaScript code we can go through our browser history and identify visited links. It is fine. But how an attacker use this to identify a victim's history. Essentially, the code should have to be executed on the victim's browser.
I know that there are XSS attack methods, persistent, non-persistent, DOM based etc. Should an attacker use one of these methods? Or is there another way? Can anybody give sample code?
Although, here (XSS attacks cross-site scripting exploits and defense-V et al) the attacking method (history stealing) is clear, how an attacker receive the history is not clear..I am interested in how really attacker receives the history in formation gathered from the code.For an example, in cookie stealing it is sent through a url to the attacker.likewise...
Any help is appreciated.