3 ms·
This is kind of irrelevant since you can pretty easily override everything about the XSS payload to make it look like a legitimate login page for the site you'r
by BeefWellington 5y ago
This is kind of irrelevant since you can pretty easily override everything about the XSS payload to make it look like a legitimate login page for the site you're looking for.
Depending on the nature of the site, it's possible it won't even stand out as odd even if it loads a login control at a non-"login" URL.
- mukesh610 5y agoHTML5 History API allows for modifying the URL too. If an attacker leverages an XSS they can exactly replicate the login page, URL and all, only limited by payload size and modern protections like CSP.