I am learning about XSS attacks. Wikipedia says that in a non-persistent attack an attacker may provide an innocent-looking URL that "points to a trusted site but actually has an XSS vector." What would this look like? Can someone provide an example?
An attacker can use a URL shorting service like bit.ly:
The XSS'ed site came from http://www.xssed.com/ !
If it is a phishing attack and the URL matters, then the attacker can URL-encode or UTF-8 encode key characters to obscure HTML tags. Most people disregard long urls anyway.
related: XSS filter Evasion Cheat Sheet.
As you can see there are two URLs: http://www.apple.com and my blog. When viewed on certain mobile Apple devices you will see www.apple.com in the address bar, but see my blog's content instead of Apple's website.
This does not have to do with XSS attacks, but it's worth mentioning the UNICODE mirror character that makes a innocent url potentially dangerous.
If you check the source code of this answer, you will see that the code is:
This could be used to be redirected to a potentially bad website.
Also, if you can't click on a link, you'll have to copy and paste it. No one is going to type it in manually!
NOTE: The mirror character does not mirror webpage!
Cross-Site Scripting is basically code that can be input on the page for you or everyone. This is the difference of non-persistent and persistent XSS.
An example of a persistent XSS would be like (you'll need script tags):
An example of a non-persistent XSS would be like (you'll need script tags):
Only people with the post data in that URL would see your alert since it wasn't stored.