Our web honeypots picked up some more XSS attacks today:
$ curl -D - http://txt2pic.comHTTP/1.1 302 Object movedServer: Microsoft-IIS/5.0Date: Fri, 30 Nov 2012 14:36:28 GMTFun: www.WHAK.comConnection: closeLocation: http://www.imagegenerator.orgContent-Length: 150Content-Type: text/htmlSet-Cookie: ASPSESSIONIDCQSCSBBC=HCPFGNFAEIIHNDEPAEFEFFHL; path=/Cache-control: privateObject moved<h1>Object Moved</h1>This object may be found <a href="http://www.imagegenerator.org">here</a>.
This server responds with a 302 redirect and sends the user onto the imagegenerator.org website. So, this attack scenario presumably is simply a method of SPAM linking to increase web traffic hits.
While this attack instance was relatively harmless, the take away from this example is that you must take care if you are ever utilizing any type of web-based log analytic processes. If you are ever using a web browser to review log file data, this type of an attack may trigger. See CAPEC-106: Cross Site Scripting through Log Files for more info.