New answers tagged owasp-top-ten
In addition to other answers, also see this about "mXSS attacks": http://www.reddit.com/r/netsec/comments/1skr62/owasp_appsec_eu_2013_how_mxss_attacks_change/
sometimes they escape "alert " parameter too, then you can use something like "onMouseOver" etc and you can find the full link here. https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet (try xss locators) moreover you can use %3C insead of < and so on... try url encoding etc. and if the text is encoded in the background, you xss may not ...
There are a lot of other dangers from XSS, not just stealing cookies. Your page could be defaced, data which is secured (for instance with ip-protection) can be stolen or it even can be used to do some time-based attacks on internal networks the attacked browser may be connected to. So you definitely should have a look at the OWASP XSS Cheat Sheet to ...
Top 50 recent answers are included