Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 30 down vote favorite
20

There is a great list of XSS vectors avaliable here: http://ha.ckers.org/xss.html, but It hasn't changed much lately (eg. latest FF version mentioned is 2.0).

Is there any other list as good as this, but up to date?

share|improve this question
4  
We need less cheatsheets/tools and more in-depth methodology manuals for findings issues such as XSS. It should also be noted that manual code review and control-based gap analysis are easier methods to find and eradicate XSS issues, especially over extremely large codebases and across a large number of applications. – atdre Nov 14 '10 at 12:55
@atdre, I agree - in principle. However, a missing control is often not enough for a business to decide to commit the resources to fix the lack. Indeed, risk management would require you to show if the flaw is exploitable, or just best-practice/defense-in-depth. – AviD♦ Nov 14 '10 at 23:53
1  
@AviD: Hahahahaha, XSS is always exploitable. I completely disagree with you. Demonstrating risk management issues through risk assessments is a total waste of time for application security! Does an organization need to practice the fine art of stealing their own trucks at gunpoint in order to prove the risk management issues with drivers going through bad neighborhoods, at night, with PR all over their location and truck contents? – atdre Nov 15 '10 at 1:27
1  
Looks like I missed out a lot through the weekend :) A word from me - I consider such cheat-sheets useful for learning what should I look out for when coding. And I don't have to be a blackhat to want to try and exploit an app without code review. (eg. an app written in my company, but in a language I'm not familiar with) – naugtur Nov 15 '10 at 9:55
1  
Actually, @naugtur, I think the comments here are extremely helpful, possibly even more than the answers themselves - but then again, I might be biased. I think the back'n'forth I had with @atdre was topical, and of high value - but probably deserved its own question/discussion. But again, I'm probably biased :) – AviD♦ Dec 6 '10 at 13:17
show 18 more comments

4 Answers

up vote 15 down vote accepted

The best new one I've seen recently is here http://heideri.ch/jso/ good list of vectors with browser support noted and has quite a few of the more obscure ones.

share|improve this answer
2  
Mario Heiderich is also releasing a book next month that should explore this and related topics more in-depth. Here is a link to the book: isbn.nu/1597496049 – atdre Nov 14 '10 at 12:53
I read the book. While some of its parts are already outdated, it's definitely a must-read if someone is into XSS, though it also covers other areas. – Krzysztof Kotowicz Sep 19 '11 at 13:19
up vote 5 down vote

Yes, grab fuzzdb from http://code.google.com/p/fuzzdb/:

fuzzdb helps identify security flaws in applications by aggregating known attack patterns, predictable resource names, and server response messages to create a comprehensive, repeatable set of malformed input test cases.

fuzzdb has a great list of attack payloads.

share|improve this answer
up vote 3 down vote

RSnake's XSS cheatsheat (that you linked to) is still pretty much the definitive reesource, and it is even referenced in OWASP's secure coding guide (which is in turn referenced by PCI:DSS).
True, since RSnake is taking a step back from that stuff, going forward this might change, but as of now thats the place to go.

UPDATE: RSnake has officially retired from blogging, and declared that he won't be making any updates. So while this may have been up-to-date up until last month, apparently it's not anymore.

share|improve this answer
1  
I think fuzzdb may supersede rsnake's xss cheatsheet given it is one of the primary sources for fuzzdb in addition to many other sources – Tate Hansen Nov 14 '10 at 23:50
up vote 8 down vote

If you really want to understand XSS, I strongly recommend OWASP's XSS Prevention Cheat Sheet. It's not focused on hacking, it's focused on helping developers prevent these problems in the first place. http://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.