difference between the XXX and Phishing

nanga

"""
By exploiting vulnerabilities in the web server, an attacker uses the website as an intermediary for transferring malicious code to another victim. In this attack, the victim is usually not aware of being exploited because he or she assumes the data received are from a valid Web server. One example of malicious action is for the attack code to copy cookies from the victim’s computer and relay them to the attacker.

A basic example of XSS is when a malicious user injects a script in a legitimate shopping site URL which in turn redirects a user to a fake but identical page. The malicious page would run a script to capture the cookie of the user browsing the shopping site, and that cookie gets sent to the malicious user who can now hijack the legitimate user’s session. """"


Then what is the difference between the XXX and Phishing ?

dynamik

You mean XSS, not XXX, right?

Cross-site scripting is just what it sounds like. The attack involves linking to an external script. It can do a lot of things at that point. What they gave you was just an example.

I can see where you're confused with that example, since it sort of leads into a phishing attack.

Wikipedia has a good overview on both:
http://en.wikipedia.org/wiki/Cross-site_scripting
http://en.wikipedia.org/wiki/Phishing