POST METHOD XSS

Cross-Site Scripting attacks could also be triggered when the data is being sent with a POST method instead of the usual GET.

We can use a Firefox add-on named “Tamper Data” or any other packet sniffer to manipulate the POST values and insert our XSS query into the POST value.

Beef (Browser Exploitation Framework)

A lot has been discussed over what could be done using Cross-Site Scripting. One way to take over the complete control of the victim using XSS is through the use of XSS Shell.

However, recently, a tool called BeeF (Browser Exploitation Framework) has been released to gain complete control of the system of victims, using a Cross-Site scripting vulnerability)

Generally in Cross-Site Scripting attacks, the attacker usually inserts a script as a payload to get the victim’s cookies or pops up an alert box. Using Beef, in XSS vulnerability, an attacker just has to insert the Beef server’s URL, listening on the attacker’s machine. As soon as the victim navigates to that page, using a JS redirection or clicking on the link, he is in complete control of the attacker.