CROSS-SITE SEARCH (XS-SEARCH) ATTACKS