I'm posting this to talk about a less known but still severe XSS attack. This attack involves spoofing your user-agent. When a page echo's your user agent it may not preform any checking and may not sanitize input. This means you can still implement XSS attacks. The site I will use here is: http://whatsmyuseragent.com/
Right, so first, download the firefox addon: User Agent Changer. This will allow you to change and customize user agents. Then go into Tools > Default User Agent > Edit User Agents
Add another one like so: [spoiler] http://img684.imageshack.us/img684/1146/201103121652121366x768s.png [/spoiler]
Now we can set our user agent to the XSS one. NOTE: You can change your XSS query to anything you'd like. You're not limited to
<script>alert(\"XSS\")</script>
Now all we gotta do is visit this webpage that displays our user agent. Here is an example of what happens: [spoiler] http://img232.imageshack.us/img232/7332/201103121657061366x768s.png [/spoiler] And boom. XSS occurs :D
Simple and easy. And occurs more than you would think since many people don't think to sanitize a user-agent.