Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is XSS dangerous when the web application doesn't have a login/register function, the user isn't logged in or when the website doesn't store any sensitive user information?

share|improve this question
up vote 10 down vote accepted

Of course!
False information could be inserted into a webpage with XSS. Imagine if Microsoft had a giant banner on their front page stating they would shut down the whole company, their shares could drop significantly, just because of a XSS attack, without anyone logging in.

share|improve this answer
Nice example! I didn't think about it! – Martin. Jan 15 '12 at 22:52

XSS is still very dangerous because it can cause a user to reveal sensitive information that isn't even necessarily to the website that they are visiting.

It can be used to run scripts, modify the page, provide other information, cause redirects etc.

share|improve this answer

Ok Let's to clarify some scenarios then you judge

  • someone found a XXS vuln in your Company Ticket System. Then he send a malicious link to them. So he can catch them privileges on the ticket system and read all of tickets (it could contains users,passwords,credits, etc) also he can catch the other Cookies.

  • someone found XXS vuln then he send a malicious link with redirect script to them to malicious website. (he can use browser vuln to execute Trojans,backdoor,keylogger,etc)

  • what if he found vuln in some public script which your customers use it then he did the previous attacks to your customers ?

Isn't Dangerous?

share|improve this answer
The first example - I said: in case that web doesn't have login/register - so - what sensitive information could be released ? someone found XXS vuln then he send a malicious link with redirect script to them to malicious website if user clicks on link, why not just give them direct link to that malicious website? – Martin. Jan 16 '12 at 11:28
@Martin - a savvy user may be wary of a link directly to another domain, whereas an XSS can hide that link so the user thinks they are just visiting their intended domain. – Rory Alsop Jan 16 '12 at 12:53
@RoryAlsop: ah, also true – Martin. Jan 16 '12 at 14:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.