Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Alerts This Week
Warning Icon 1 581
Alerts This Week
Warning Icon 1 581

Exploiting XSS: Capturing User Search Queries with JavaScript

Calendar Oct 03, 2006 • User Avatar Anthony Pell
1 min read
General Esm H446
Topics%20covered

Topics Covered

cross-site scripting javascript web attack data theft security analysis search query theft harmful script
SPI Labs has discovered a practical method of using JavaScript to detect the search queries a user has entered into arbitrary search engines. All the code needed to steal a user's search queries is written in JavaScript and uses Cascading Style Sheets (CSS). This code could be embedded into any website either by the website owner or by a malicious third party through a Cross-site Scripting (XSS) attack. There it would harvest information about every visitor to that site.