Few weeks ago I demonstrated a Proof of Concept of how easy it is to create an Ajax worm which hijacks a user session and redirects all the user activity through itself. The idea is simply to be able to control and monitor the user activity on a website by inserting the malicious script into the visiting users session using XSS. I have been advocating for some time now, the extent of damage that can be done using Ajaxs XMLHttpRequest(XHR) object.
