79
Related Attack Patterns
CAPEC-ID Attack Pattern Name
63 Cross-Site Scripting (XSS)
85 AJAX Footprinting
209 XSS Using MIME Type Mismatch
588 DOM-Based XSS
591 Reflected XSS
592 Stored XSS
References
[REF-709]Jeremiah Grossman, Robert "RSnake" Hansen, Petko "pdp" D. Petkov, Anton Rager and
Seth Fogie. "XSS Attacks". 2007. Syngress.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-712]"Cross-site scripting". 2008 August 6. Wikipedia. < https://en.wikipedia.org/wiki/Crosssite_
scripting >.2023-04-07.
[REF-7]Michael Howard and David LeBlanc. "Writing Secure Code". 2nd Edition. 2002
December 4. Microsoft Press. < https://www.microsoftpressstore.com/store/writing-securecode-
9780735617223 >.
[REF-714]RSnake. "XSS (Cross Site Scripting) Cheat Sheet". < http://ha.ckers.org/xss.html >.
[REF-715]Microsoft. "Mitigating Cross-site Scripting With HTTP-only Cookies". < https://
learn.microsoft.com/en-us/previous-versions//ms533046(v=vs.85)?redirectedfrom=MSDN
>.2023-04-07.
[REF-716]Mark Curphey, Microsoft. "Anti-XSS 3.0 Beta and CAT.NET Community Technology
Preview now Live!". < https://learn.microsoft.com/en-us/archive/blogs/cisg/anti-xss-3-0-beta-andcat-
net-community-technology-preview-now-live >.2023-04-07.
[REF-45]OWASP. "OWASP Enterprise Security API (ESAPI) Project". < http://www.owasp.org/
index.php/ESAPI >.
[REF-718]Ivan Ristic. "XSS Defense HOWTO". < https://www.trustwave.com/en-us/resources/
blogs/spiderlabs-blog/xss-defense-howto/ >.2023-04-07.
[REF-719]OWASP. "Web Application Firewall". < http://www.owasp.org/index.php/
Web_Application_Firewall >.
[REF-720]Web Application Security Consortium. "Web Application Firewall Evaluation Criteria". <
http://projects.webappsec.org/w/page/13246985/Web%20Application%20Firewall%20Evaluation
%20Criteria >.2023-04-07.
[REF-721]RSnake. "Firefox Implements httpOnly And is Vulnerable to XMLHTTPRequest". 2007
July 9.
[REF-722]"XMLHttpRequest allows reading HTTPOnly cookies". Mozilla. < https://
bugzilla.mozilla.org/show_bug.cgi?id=380418 >.
[REF-723]"Apache Wicket". < http://wicket.apache.org/ >.
[REF-724]OWASP. "XSS (Cross Site Scripting) Prevention Cheat Sheet". < http://www.owasp.org/
index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet >.
CWE Version 4.14
CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CWE-80: Improper Neutralization of Script-
Related HTML Tags in a Web Page (Basic XSS)