Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been reading up on non-persistent XSS and all of the examples I have found use the situation where a webpage takes something from the url/query string and places it on the page.

Is there any way to execute a non-persistent XSS attack without using the URL or query string?

share|improve this question
up vote 4 down vote accepted

Any time an application is building HTML from attacker controlled input it becomes a vector for XSS. For instance HTML5/JS applications on the Tizen and WebOS platforms can be subject to XSS via any number of vectors including Bluetooth, e-mail, Malicious NFC tags, and just about anything else you could imagine. Because JavaScript is building the HTML this falls under the bigger category of DOM Based XSS.

As a participant in the Google Bug Bounty Program I found XSS in Google Music by uploading an mp3 file with JavaScript in the ID3 tags. The application was displaying the Album name and Band name on the page, and that was enough.

share|improve this answer
Heh, that's smart. I wonder how many other sites have persistent XSS from file metadata... – Polynomial Dec 4 '12 at 7:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.