View source for XSCF

{{expand}}
{{merge|XSS}}
=Introduction=
<b>C</b>ross-<b>S</b>ite <b>C</b>ontent <b>F</b>orgery is a [[vulnerability]] class that entails malforming the server-side mimetype for a particular resource to make it appear as something else.  
{{notice|This is by no means original, however the [[Facebook]] wiki documents [[Facebook#Proof_of_Concept|how to do this in detail]].}}

For example, you could have an innocent looking image file hosted somewhere, using apache directives such as "AddType" you can force the content-type of the resource to be processed server-side by any application.

When the application seizes control of the resource, you can wrap that resource into the functions of a program, wherein the output would be returned to the client

This vulnerability is possible because content-crawler bots make easily identifiable requests.



{{series
| Name = XSCF
| PartOf = Web Exploitation
}}