Possible to execute a non-persistent XSS attack without using the url/query string?

Question

I've been reading up on non-persistent XSS and all of the examples I have found use the situation where a webpage takes something from the url/query string and places it on the page.

Is there any way to execute a non-persistent XSS attack without using the URL or query string?

Answer 1

Any time an application is building HTML from attacker controlled input it becomes a vector for XSS. For instance HTML5/JS applications on the Tizen and WebOS platforms can be subject to XSS via any number of vectors including Bluetooth, e-mail, Malicious NFC tags, and just about anything else you could imagine. Because JavaScript is building the HTML this falls under the bigger category of DOM Based XSS.

As a participant in the Google Bug Bounty Program I found XSS in Google Music by uploading an mp3 file with JavaScript in the ID3 tags. The application was displaying the Album name and Band name on the page, and that was enough.