I was trying to make a PoC of XSS:
I have injected script into the value:
<html> <body> <form action="https://test.com/api/users.prefs.set?t=1447648400" method="POST"> <input type="hidden" name="name" value="emoji_use" /> <input type="hidden" name="value" value="<script>alert('xss')</script>" /> <input type="hidden" name="token" value="xoxs-14407185377-14407185393-14621684436-9d317bf841" /> <input type="hidden" name="_attempts" value="1" /> <input type="submit" value="Submit request" /> </form> </body> </html>
And I was able to get successful response from browser with
<script>alert('xss')</script>. Now the script got injected and reflected at response I pointed out it as reflected XSS. The problem is that the alert doesn't get popped up, so it's just coming it as browser response.
Now my developer argues that the since the script doesn't get executed at the browser, so it's not vulnerable. How can I make proof of concept for this?
Possible exploitation which I can think of is to send a crafted link to the developer with beef and controlling the machine to prove the vulnerablity.
Any other way to prove the reflected XSS or any possible explanation which convinces my developer? I'm seeking suggestions from community, any other ideas to prove it?