I am practicing pen testing what is the exploit which I can use if I find my target website vulnerable to XSS injection. I injected <script>alert(1);</script> and it responded?
IIRC XSS means you can access the "host" page via a website in an iframe on a different domain. the alert should be executed in the iframe's context so "no problem here" (though you could still phish someone with that, but it's not xss.)
@AviD true, it seems I only included a subset of XSS in my answer, and an alert can be used depending where it comes from (e.g. user signature or name and this kind of thing).
It's morning, I'm not woken up yet. (After eating, I'm digesting, and on evening I'm tired.)
