I found a way to use a locally hosted XML with embedded JavaScript that is generated using an XML data island. This is a pretty nice little vector if you can include an file on the server in question.

This entry was posted on Thursday, January 1st, 1970 at 12:00 am and is filed under XSS, Webappsec. Responses are currently closed, but you can trackback from your own site.