Post #1560417

I’m reminded of the disconnect between typical vuln scan/pentest XSS findings and real world exploitation by this write up of Russian exploitation of webmail apps https://ctrlaltintel.com/threat%20research/FancyBear/ How do you demonstrate XSS impact beyond the classic alert dialog or cookie stealer?