6

Is XSS dangerous when the web application doesn't have a login/register function, the user isn't logged in or when the website doesn't store any sensitive user information?

3 Answers 3

10

Of course!
False information could be inserted into a webpage with XSS. Imagine if Microsoft had a giant banner on their front page stating they would shut down the whole company, their shares could drop significantly, just because of a XSS attack, without anyone logging in.

1
  • Nice example! I didn't think about it!
    – Martin.
    Jan 15, 2012 at 22:52
3

XSS is still very dangerous because it can cause a user to reveal sensitive information that isn't even necessarily to the website that they are visiting.

It can be used to run scripts, modify the page, provide other information, cause redirects etc.

2

Ok Let's to clarify some scenarios then you judge

  • someone found a XXS vuln in your Company Ticket System. Then he send a malicious link to them. So he can catch them privileges on the ticket system and read all of tickets (it could contains users,passwords,credits, etc) also he can catch the other Cookies.

  • someone found XXS vuln then he send a malicious link with redirect script to them to malicious website. (he can use browser vuln to execute Trojans,backdoor,keylogger,etc)

  • what if he found vuln in some public script which your customers use it then he did the previous attacks to your customers ?

Isn't Dangerous?

3
  • The first example - I said: in case that web doesn't have login/register - so - what sensitive information could be released ? someone found XXS vuln then he send a malicious link with redirect script to them to malicious website if user clicks on link, why not just give them direct link to that malicious website?
    – Martin.
    Jan 16, 2012 at 11:28
  • @Martin - a savvy user may be wary of a link directly to another domain, whereas an XSS can hide that link so the user thinks they are just visiting their intended domain.
    – Rory Alsop
    Jan 16, 2012 at 12:53
  • @RoryAlsop: ah, also true
    – Martin.
    Jan 16, 2012 at 14:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.