Types of Web application vulnerability

1. XSS (Cross Site Scripting)
2. SQL Injection
3. RFI
4. etc
1.) XSS
XSS is a type of computer security vulnerability typically found in web applications
which allow code injection by malicious web users into the web pages viewed by
other users.
Websites today are more complex than ever, containing a lot of dynamic content
making the experience for the user more enjoyable. Dynamic content is achieved
through the use of web applications which can deliver different output to a user
depending on their settings and needs. Dynamic websites suffer from a threat that
static websites don't, called "Cross Site Scripting" (or XSS dubbed by other security
professionals). Currently small informational tidbits about Cross Site Scripting holes
exist but none really explain them to an average person or administrator. This FAQ
was written to provide a better understanding of this emerging threat, and to give
guidance on detection and prevention.
Cross Site Scripting is a technique used to add script to a trusted site that will be executed
on other users browsers. A key element to XSS is that one user can submit data to a
website that will later be displayed for other users. It is nessesary that the bad guy NOT
mess up the HTML structure, otherwise the result will be web defacement rather then
attacking other users.
"What are the threats of Cross Site Scripting?"
Often attackers will inject JavaScript, VBScript, ActiveX, HTML, or Flash into a
vulnerable application to fool a user (Read below for further details) in order to gather
data from them. Everything from account hijacking, changing of user settings, cookie
theft/poisoning, or false advertising is possible. New malicious uses are being found
every day for XSS attacks. The post below by Brett Moore brings up a good point
with regard to "Denial Of Service", and potential "auto-attacking" of hosts if a user
simply reads a post on a message board.
Cross-Site Request Forgery, also known as one click attack or session riding and
abbreviated as CSRF (Sea-Surf) or XSRF, is a kind of malicious exploit of websites.
Although this type of attack has similarities to cross-site scripting (XSS), cross-site