Backdoor and debug options Developers often create backdoors and turn on debugging to facilitate troubleshooting in applications. This works fine in the development process, but these items are often left in the final application that's placed on the Internet. Backdoors that let a user log in with no password or a special URL that allows direct access to application configuration are quite popular. In general, it's the process of inserting code into pages sent by another source. One way to exploit cross-site scripting is through HTML forms.
Forms let a user type any information and have it sent to the server.
Often, servers take the data input in the form and display it back to the user in an HTML page to confirm the input. If the user types code, such as a JavaScript program, into a form field, the server processing the form might execute the code if there aren't any input checks. Parameter tampering Parameter tampering involves manipulating URL strings to retrieve information the user shouldn't see. Most Web applications include a back-end database and the URL includes a SQL call to this database. Malicious users can manipulate the SQL code to potentially retrieve a listing of all users, passwords, credit card numbers, or any other data stored in the database.