Chapter 4

1. Stored/Persistent, Reflected, and DOM Based XSS are three common varieties of XSS.
2. Persistent XSS is particularly dangerous because the malicious code stored in the server can be served up to a large number of users.
3. There are a lot of false positives associated with XSS discovery. XSS Validator helps boost the signal through the noise.
4. The XSS Validator phantomjs server listens for possible vulnerabilities and performs validation checks on them.
5. Use the Payload Positions feature in the Payloads tab in Burp Intruder.
6. All of the usual contextual data is important (URL location, input, and so on), but the payload is most essential.
7. An XSS vulnerability could allow an attacker to steal admin account credentials and take the actions of a superuser for a particular service and organization.
8. Including an attack scenario convinces the team receiving the report that they should...