Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If one of the common uses of XSS is to steal cookies which will be sent to the attacker's server, isn't it so easy to identify the attacker?

This is not like a SQLi for example which you can exploit using VPNs and proxy chains. In this case you have to provide a URL that you can control for retrieve the host, therefore, you can be easily tracked. Am I wrong?

share|improve this question

closed as not constructive by Lucas Kauffman, Noordung, AJ Henderson, Adnan, Eric G Jun 24 '13 at 14:50

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

1  
VTC: not constructive –  Lucas Kauffman Jun 24 '13 at 11:48
    
And you base your opinion in? –  yzT Jun 24 '13 at 11:55
1  
Because you already made your conclusion for one –  Lucas Kauffman Jun 24 '13 at 12:25
    
That's a question, not a conclusion. –  yzT Jun 24 '13 at 12:26
2  
I have to agree with @LucasKauffman here. This question is rhetorical, and discussing an inherent property of an XSS exploit - that it's cross-site. The XSS hosting server could as well have been exploited, you would have no way of knowing the requests are not forwarded to another server, those to another server, e.t.c. ad infinitum. Assuming the XSS hosting server was not exploited - well then you've already answered your question, attacker's IP would be the one the requests are forwarded to. The answer could then be: It varies from extremely easy to nigh impossible. Not constructive. ;) –  Noordung Jun 24 '13 at 12:47

1 Answer 1

Only beginners would employ their own domain to execute the cookie-stealing attack described. Most attackers will use a compromised domain, usually vulnerable to a public exploit.

Hence, any tracking activities will almost certainly lead to a compromised web application, without providing information about the real attacker.

Furthermore, an attacker exploititing a Stored XSS vulnerability can do it behind a VPN or a proxy, effectively conceiling his/her own position and identity.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.