Inject scripts into browser

in 2006, XSS vulnerabilities made up almost 70%

education has the highest vulnerabilty

XSS is usually just the first step in a larger attack

XSS is Platform independent

XSS Can spread much faster than traditional viruses/malware

Vulnerability only exists in the URL

doing an example on nbc.com

Now he is hacking cornell.edu

htmlpurifier.org

php-ids.org

Steps: Input Filtering, Input Validation, Output Encoding

AntiSamy

XSS Me - a firefox extension that checks vulnerabilities in the current page.

every app at Mizzou has to go through an injection/XSS audit before launch.

excellent session

scary stuff - where to begin with our own site???