I'm about to graduate in "Computer Science", and I'm writing thesis about the Javascript vulnerabilities. In particular, I'm analyzing the JS vulnerabilities that allow XSS attacks.

I would like to report in a specific chapter some famous attack which exploited JS vulnerabilities. Does anyone know the existence of such attacks occurred in recent history?


The most famous has got to be the Samy worm:

Samy (also known as JS.Spacehero) is a XSS worm that was designed to propagate across the MySpace social-networking site written by Samy Kamkar. Within just 20 hours of its October 4, 2005 release, over one million users had run the payload making Samy the fastest spreading virus of all time.

The worm itself was relatively harmless, it carried a payload that would display the string "but most of all, samy is my hero" on a victim's MySpace profile page. When a user viewed that profile page, the payload would then be replicated and planted on their own profile page continuing the distribution of the worm. MySpace has since secured its site against the vulnerability, however certain MySpace profiles still display evidence of the worm to this day.

There was also xssed which keeps a record of real exploits, however it appears to no longer be maintained.

| improve this answer | |
  • 1
    There is an inexhaustible supply of real xss exploits at the xss subreddit – mcgyver5 Jul 29 '15 at 14:35

Here you are:

  • List of 20 famous websites vunerable to XSS

    20 Famous websites vulnerable to Cross Site Scripting (XSS) attack including famous newspapers, federal agencies and the biggest fast food restaurant in the world.

  • Notable attacks in 2011

    Basically the same question but answered back in 2011.

  • Also Y! got pwned

    Popular webmail provider Yahoo has been slammed with a new e-mail-based attack that seizes control of victims’ accounts. Bitdefender Labs discovered the ongoing campaign today and are once again warning users about the dangers of clicking spammy links.

| improve this answer | |
  • Please don't post links only as these might die leaving this answer unusable. – BadSkillz Jul 29 '15 at 14:00
  • 1
    lol, I like that this answer is getting torn up for "link-only", but in the linked question @RoryAlsop's didn't. – Mike Ounsworth Jul 29 '15 at 15:01
  • good point @MikeOunsworth :-) – user69377 Jul 29 '15 at 15:28
  • Mike - that is a good point. While I might excuse it as 'this was back in the old days when things were different' - I think I should have answered properly. However in reading that question now, it deserves to be closed anyway :-) – Rory Alsop Jul 29 '15 at 22:53

As a quick and straightfarward answer, you can look to these famous JS worms achieved by exploiting XSS vulnerabilities:

  1. Justin.tv worm

The cross-site scripting vulnerability that was exploited was that the "Location" profile field was not properly sanitized before its inclusion in a profile page.

  1. Orkut "Bom Sabado" worm

Orkut, a social networking Site, was also hit by a XSS worm. Infected users receive a scrap containing the words "Bom Sabado" (Portuguese, "Happy Saturday"). Google has yet to comment on the situation.

You will find more real world -and recent- examples by searching here according to the criterions you want:

Also, interesting to read: XSS bug in hotmail login page.

| improve this answer | |

The other answers are great, but I thought I'd share one additional story I remember -- http://www.zdnet.com/article/strongwebmail-ceos-mail-account-hacked-via-xss/

Lance James and crew found an XSS when facing a challenge brought about by StrongWebMail's CEO (in the style of LifeLock). They were able to successfully win the challenge through the use of the XSS (the CEO fell for the attack in a phishing email that was crafted specifically to him), but the CEO reneged when the prize was to be awarded. The CEO's claim was the XSS is not hacking, and therefore didn't quality for the prize.

Eventually, Lance and team did get paid the $10,000 prize, with more details here -- https://web.archive.org/web/20111211040709/http://www.fireblog.com/exclusive-interview-with-strongwebmails-10000-hacker/

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.