Cross Site Scripting can be used to
-
Steal cookies
-
Hijack accounts
-
Execute Flash/ActiveX contents
-
Force user to download s/w
-
All the above
Cross Site Scripting (XSS) attacks allow malicious scripts to be injected into web pages viewed by other users. These scripts can access cookies (enabling session theft), hijack user accounts by stealing authentication credentials, execute malicious ActiveX or Flash content (in legacy systems), and force downloads of malicious software. All listed outcomes are possible XSS attack vectors.
Cross-Site Scripting (XSS) lets an attacker inject and run arbitrary script in a victim's browser session, which can be used to steal session cookies, hijack logged-in accounts, trigger malicious plugin content, or trick the user into downloading malicious software — so all the listed capabilities are valid attack outcomes.