跨站脚本(Cross Site scr ipting)攻击是指在远程Web页面的HTML代码中插入恶意的JavaScriP、VBScrip，ActiveX、HTML或Flash等脚本，窃取浏览此页面的用户的信息，改变用户的设置，破坏用户数据的攻击技术。跨站脚本攻击在多数情况下不会对服务器和Web程序的运行造成影响，但对客户端的安全会构成严重的威胁，这主要是由于服务器对用户提交的数据过滤不完整造成的
Lock down next-generation Web services “This book concisely identifies the types of attacks which are faced daily by Web 2.0 sites, and the authors give solid, practical advice on how to identify and mitigate these threats.” –Max Kelly, CISSP, CIPP,
Over 75% of network attacks are targeted at the web application layer. This book provides explicit hacks, tutorials, penetration tests, and step-by-step demonstrations for security professionals and Web application developers to defend their most vu
英文版 10 Quick Facts About XSS Viruses and Worms" 5 An Overview of Cross-Site scr ipting (XSS)" 6 Non-Persistent" 6 Persistent" 9 How They Do It: Methods of Propagation" 10
目前较好的一本介绍跨站脚本攻击（XSS）的书Cross Site scr ipting Attacks starts by defining the terms and laying out the ground work. It assumes that the reader is familiar with basic web programming (HTML) and Javascr ipt. First it discusses the concepts, methodology,
Cross-Site Request Forgery (CSRF) is a widely exploited web site vulnerability. In this paper, we present a new vari- ation on CSRF attacks, login CSRF, in which the attacker forges a cross-site request to the login form, logging the vic- tim into th
