Penetration Testing: Re: XSS vulnerability on Apache Tomcat server

[Muhammad Faisal Rauf Danka <mfrd () attitudex com>]

First of all, read this :
http://www.cgisecurity.net/articles/xss-faq.shtml

Then if you findout that the webserver itself is vulnerable to XSS, which i doubt. 
You might have found a CGI hosted on the server vulnerable to XSS, in any case once you find out for sure, then see if 
that website/CGI is responsible for issuing cookies or for the Authentication of cookies.
If it is not, then your XSS alert is going to be an alert only in your Final Report, and you could say that the 
bad-coding or non-security conscious coding practices have been exercised during coding of CGI's.


Regards
--------
Muhammad Faisal Rauf Danka

Head of GemSEC / Chief Technology Officer
Gem Internet Services (Pvt) Ltd.
web: www.gem.net.pk
Key Id: 0x784B0202
Key Fingerprint: 6F8C EDCF 6C6E 06A5 48D7  6A20 C592 484B 
784B 0202

_____________________________________________________________
---------------------------
[ATTITUDEX.COM]
http://www.attitudex.com/
---------------------------

_____________________________________________________________
Promote your group and strengthen ties to your members with email () yourgroup org by Everyone.net  
http://www.everyone.net/?btn=tag

----------------------------------------------------------------------------
This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
Service. For more information on SecurityFocus' SIA service which
automatically alerts you to the latest security vulnerabilities please see:
https://alerts.securityfocus.com/