Its been quite a while since I have played with cross site scripting vulnerabilities but today I came across a website today that was crying out to be tested for a basic XSS vulnerability.
So dutifully I typed in:
And was quite surpised when I wasn't met with an alert box showing the message 'hey!'.
I checked the source and could see the code was clearly being injected and when I tried something more simple such as:
It injected the HTML as expected.
This is when I checked my error log and saw this message (in Chrome):
After a bit of investigation I found that this is a feature called "Reflective XSS Protection " that was introduced in to webkit. If code is seen in both the query and the body then it won't be executed.
So my question: When I've played around with cross site scripting in the past this is basically how I've done it. Does this effectively wipe out a great deal of XSS attacks or just the primitive ones?