Free cross site scripting software for windows

Microsoft Windows 2000 Patch: Indexing Service Cross Site Scripting Update is written to be a handy program which can help tackle the "Indexing Services Cross Site Scripting" vulnerability in Indexing Services for Windows 2000 and discussed in Microsoft Security Bulletin MS00-084. Download now to prevent a malicious user from introducing code on your Web server and returning it as a Web page to a visiting browser.

Indexing Services is a search engine that is integrated with Internet Information Services (IIS) 5.0 and Windows 2000 that allows browsers to perform full-text searches of Web sites. Indexing Services does not properly validate all search inputs before processing them, and is consequently vulnerable to Cross-Site Scripting (CSS). CSS allows a malicious user to "inject" code into another person's Web session. If a malicious user is successful in exploiting this vulnerability, he or she can use a Web site hosted by your server to run code on a visting user's browser each time it returns to your Web site.

Note Indexing Services ships and installs with Windows 2000, but is not enabled by default. If you are running Web servers on Windows 2000 and you have enabled Indexing Services, Microsoft recommends that you apply this update.

Microsoft IIS4 "Cross-Site Scripting" Vulnerability Patch (MS00-060) is a professional and smart patch which eliminates security vulnerabilities in the Microsoft Internet Information Server.

The vulnerabilities could allow a malicious Web site operator to misuse another Web site as a means of attacking users. This vulnerability, known as Cross-Site Scripting (CSS), results when Web applications don't properly validate inputs before using them in dynamic Web pages. If malicious Web site operators were able to lure a user to their site, and had identified a third-party Web site that was vulnerable to CSS, they could potentially use the vulnerability to ""inject"" script into a Web page created by the other Web site, which would then be delivered to the user.

The net effect would be to cause the malicious user's script to run on the user's machine. The vulnerability can affect any software that runs on a Web server, accepts user input, and blindly uses it to generate Web pages. Microsoft recommends that all vendors check their products to see if any are affected by the vulnerability, and initiated a check of its own products, as well. Several features in IIS were found to be affected--some were found by Microsoft internal teams, and others were identified by customers--and this patch eliminates all of them.