Blast from the Past: Cross Site Scripting on the AWS Console

Re:Blast from the Past: Cross Site Scripting on the AWS Console by tylerd22 on Wednesday July 01, 2020 @03:45PM (#23705657)

xss is surprisingly hard to prevent because user input must be escaped differently depending on context (html, css, js, json).

User input also shows up in surprising locations such as dns records and whois info.

Luckily, an effective xss attack e.g. targetting the admin of a target website, often require a large amount of effort and social engineering.

[ Parent | on HN ]

Re:Blast from the Past: Cross Site Scripting on the AWS Console by kerng on Wednesday July 01, 2020 @04:01PM (#23705861)

This is especially true for reflected attacks, besides doing target spear phishing via email or messenger apps it won't be succesful.

For persistent attacks, its mostly just sit and wait for an attacker - they don't really control when/if a user visits the compromised page.

[ Parent | on HN ]