As I understand it, the basic idea of XSS is to let the user's browser execute some malicious code created by the hackers.
Say, if a page has a vulnerability of loading arbitrary script when user access this URL:
http://www.example.com/apage?filename=malicious.js
Then the browser will load the malicious.js
file without any question, and the user will be hacked.
My question is, how do hackers make the user access such an URL?
As in the case above and all other techniques like it, all have one precondition: the user has to take some action that they wouldn't usually take.
If the hacker has to come to say "hi, there is something funny, take a look!" to everyone, that won't be a very effective attack.
So, are there any tricks to make this happen automatically? Or any real-life cases that cause this?