Amol Naik has discovered and successfully exploited a cross-site scripting bug that initially seemed unexploitable. In this paper, Amol describes in detail the exploitation steps.
A beginners guide to cross-site scripting (XSS) vulnerabilities with examples, authored by Offensive Security Certified Expert MaXe, founder of the famous Intern0t underground security training community.
An interesting blog post by Google's Online Security Team, ntroducing Automatic Context-Aware Escaping (Auto-Escape for short), a functionality the team added to two Google-developed general purpose template systems to better protect against Cross-Site Scripting (XSS).
An interesting paper by p3lo concerning the new XSS vectors, javascript malware obfuscation
, url cache poisoning, packing, frame jacking techniques etc..
