2

I was going through the OWASP XSS Filter Evasion Cheat Sheet and and I came across this section where there is an anchor tag used to do an XSS in the following forms:

<A HREF="//google">XSS</A>
<A HREF="http://ha.ckers.org@google">XSS</A>
<A HREF="http://google:ha.ckers.org">XSS</A>

I can imagine its use in a stored XSS attacks (like some forum post saying "Click me") but I cannot imagine its use in a Reflected XSS attack. Can anyone tell if it's possible to do a reflected XSS using the anchor tag? If yes, how?

Improve this question

2 Answers 2

Reset to default
0

When there is information used to form the link itself, then it can be done: Imagine a page: http://site.com/redirect.php?target=google.com which will show one of those "You are leaving site.com, we're not responsible... click here to ...". It may put part of your URI (the target parameter) into the HTML code.

If you'd try to escape this with "google.com"%20onclick="alert(document.cookie)", you could form the following:

<a href="http://google.com" onclick="alert(document.cookie)">

Of course, there are many if's - but it can be done.

Improve this answer
1
  • The OWASP document stated Assuming "http://www.google.com/" is pro grammatically [sic] disallowed meaning that anything starting with that string would not be accepted. The document is discussing URL blacklisting rather than how to escape out of a quoted <a> tag.
    – SilverlightFox
    Commented Jun 15, 2015 at 12:29
2

Sure it's possible as long as a site uses non-persistant data to construct an anchor tag without properly sanitizing the data. A contrived example:

<a href="/whatever?s={Write unsanitized query string value here}">{or maybe here?}</a>

That being said, the link that you posted has to do with URL string evasion and not reflected XSS. Is it possible you are confused on what reflected XSS is? Or possibly I just misunderstood your question :)

Improve this answer
2
  • Na. What you wrote non-persistant data being used to create a query tag answers my question. But I had to accept one answer and the other answer seemed close enough. So, just upvoting it.
    – Pervy Sage
    Commented May 6, 2014 at 19:31
  • Not every XSS is remediated by proper encoding of the HTML output. In particular, if the anchor's href attribute's value is generated entirely from an input, the latter needs white-listing for reflection of only authorized URLs or, at least, for reflection of URLs starting with https://. This is because reflecting javascript:alert(1) in href is dangerous due to abusing the trust in clickable links rather than abusing the insufficient encapuslation of input on output.
    – eel ghEEz
    Commented Nov 10, 2020 at 2:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .