Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is there any plugin out there which prevent reflected XSS? Plugin could be either for firefox or chrome.

Thanks.

share|improve this question

closed as off-topic by NULLZ, Xander, Adnan, Noordung, Iszi Oct 3 '13 at 18:37

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

    
no-script for firefox, none of these filers work very well. –  Rook Oct 1 '13 at 16:30

1 Answer 1

Chrome ( and most likely Firefox ) already prevent execution of scripts when they are given in for example the URL parameter, maybe even other things like a request body, and then proceed to give you a warning.

See also Does Google Chrome protect against cross site scripting (XSS)?

Also when you search for XSS prevention in the chrome extension store, you will get results.

share|improve this answer
    
I tried a reflected XSS on insecurelabs.org/Task/Rule1. It works in chrome as well as firefox. here search box in vulnerable to xss –  Naman Oct 1 '13 at 14:49
    
That website sends an http header of "X-XSS-Protection:0", you can guess what that does. You cannot use that website to test a browser's XSS Protection. See also this question –  Philipp Oct 1 '13 at 15:11
    
Nice. But now I am making a simple page and running it on apache local server, still reflected xss happening –  Naman Oct 1 '13 at 17:01
    
What would you say about victim.kotowicz.net/alphabet-hero/vuln.html –  Naman Oct 1 '13 at 17:04
    
That is a page where javascript reads the input field and just appends the text as html, the xss data does not come from a request... –  Philipp Oct 2 '13 at 7:24

Not the answer you're looking for? Browse other questions tagged or ask your own question.