RE: Detecting cross-site scripting attacks

["Calderon, Juan C (CORP, DDEMESIS)" <Juan.Calderon () ddemesis ge com>]

*******************
I am new to web application security, a lot of layer 7 application 
security products detect cross-site scripting attacks (ex: sanctum 
appshield). How these products do?
*******************

I agree with Roshen, this products look for <script> tags into the Query string (parameters part of URL) or the POST 
bytes flow into HTTP requests.

How ever not only this tag could be used for data stealing, some other like <FORM> can be used as well by "replacing" 
real forms, making users send sensitive information to a diferent site that the one intended. This is the same basis 
than in XSS, except that your are not running any script.

you may find interesting this article from CERT
http://www.cert.org/advisories/CA-2000-02.html