the-web-application-hackers-handbook

Chapter 12 n Attacking Users: Cross-Site Scripting 445
Figure 12-7: A reflected XSS attack injecting Trojan functionality
The URLs in these attacks point to the authentic domain name of the actual
application, with a valid SSL certificate where applicable. Therefore, they are
far more likely to persuade victims to submit sensitive information than pure
phishing websites that are hosted on a different domain and merely clone the
content of the targeted website.
Inducing User Actions
If an attacker hijacks a victim’s session, he can use the application “as” that
user and carry out any action on the user’s behalf. However, this approach to
performing arbitrary actions may not always be desirable. It requires that the
attacker monitor his own server for submissions of captured session tokens from
compromised users. He also must carry out the relevant action on behalf of every
user. If many users are being attacked, this may be impractical. Furthermore,
it leaves a rather unsubtle trace in any application logs, which could easily be
used to identify the computer responsible for the unauthorized actions during
an investigation.