This document discusses using cross-site scripting (XSS) attacks to tunnel HTTP traffic by establishing an XSS channel. It works by embedding a script in a vulnerable site that can make requests to another domain, allowing an attacker to exfiltrate data or establish a remote shell. This technique is better than classic XSS attacks as it provides a covert channel that is difficult for the victim to detect.

1. XSS Tunnelling
Tunnelling HTTP traffic through XSS Channels
Ferruh Mavituna
www.portcullis-security.com
XSS Tunnelling ................................................................................................................1
About XSS Tunnelling..................................................................................................1
What Is An XSS Channel?........................................................................................... 2
How Does XSS Shell Work?........................................................................................ 2
Points of Interest ..................................................................................................... 4
Why Is It Better Than The Classic XSS Attacks? ..................................................