Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any plugin out there which prevent reflected XSS? Plugin could be either for firefox or chrome.

Thanks.

share|improve this question

closed as off-topic by NULLZ, Xander, Adi, TildalWave, Iszi Oct 3 '13 at 18:37

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

    
no-script for firefox, none of these filers work very well. – rook Oct 1 '13 at 16:30

Chrome ( and most likely Firefox ) already prevent execution of scripts when they are given in for example the URL parameter, maybe even other things like a request body, and then proceed to give you a warning.

See also Does Google Chrome protect against cross site scripting (XSS)?

Also when you search for XSS prevention in the chrome extension store, you will get results.

share|improve this answer
    
I tried a reflected XSS on insecurelabs.org/Task/Rule1. It works in chrome as well as firefox. here search box in vulnerable to xss – Naman Oct 1 '13 at 14:49
    
That website sends an http header of "X-XSS-Protection:0", you can guess what that does. You cannot use that website to test a browser's XSS Protection. See also this question – Philipp Oct 1 '13 at 15:11
    
Nice. But now I am making a simple page and running it on apache local server, still reflected xss happening – Naman Oct 1 '13 at 17:01
    
What would you say about victim.kotowicz.net/alphabet-hero/vuln.html – Naman Oct 1 '13 at 17:04
    
That is a page where javascript reads the input field and just appends the text as html, the xss data does not come from a request... – Philipp Oct 2 '13 at 7:24

Not the answer you're looking for? Browse other questions tagged or ask your own question.