Web-Security
Cross-Site Scripting (XSS) — Injecting Malicious Code into Trusted Web Applications
Cross-Site Scripting (XSS) is a web vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This SECMONS glossary entry explains how XSS works, its types, real-world impact, and how defenders can prevent it.
Drive-By Compromise — When Visiting a Website Is Enough
A drive-by compromise is an attack technique where a victim’s system is compromised simply by visiting a malicious or compromised website. This SECMONS glossary entry explains how drive-by attacks work, how they relate to browser vulnerabilities and zero-days, and what defenders should monitor.
Exploit Kit — Automated Browser Exploitation Infrastructure
An exploit kit is a toolkit hosted on attacker-controlled infrastructure that automatically scans visiting systems for vulnerabilities and delivers exploits without user interaction beyond visiting a page. This SECMONS glossary entry explains how exploit kits work, their role in drive-by compromise campaigns, and why patch velocity is critical.
Watering Hole Attack — Targeting Victims Through Trusted Websites
A watering hole attack is a targeted strategy where attackers compromise a website frequently visited by a specific group and use it to deliver exploits or malware. This SECMONS glossary entry explains how watering hole attacks work, how they differ from mass exploit kits, and how defenders can detect and mitigate them.