How to detect XSS in HTTP/1.1 GET requests? A request can be malicious and I want to know how to detect if the GET request to a server is trying to XSS my website?


You should not only protect yourself from XSS by scanning HTTP requests for attacks. Such a scan will never be complete, and there will always be some smart tricks that slip through the net. Your first line of defence must always be to properly sanitize untrusted data, so as not to create any XSS vulnerabilities in the first place.

For how to do that, see OWASPs cheat sheat on the topic. If possible, I would recommend you to set the Content Security Policy header strictly, as this will give you a solid defence on modern browsers. It even has a reporting directive that will instruct the browser to inform you about attempted attacks.

That said, for defence in depth it can be good to also scan HTTP requests to filter out any XSS attacks you can detect. Most web application firewalls, like Naxsi for Nginx, will do that. I recommend using an existing WAF here and not try to roll your own - there is no simple regex that will catch all XSS attacks.

So how does Naxsi do it? According to themself:

This module, by default, reads a small subset of simple (and readable) rules containing 99% of known patterns involved in websites vulnerabilities. For example, <, | or drop are not supposed to be part of a URI.

Being very simple, those patterns may match legitimate queries, it is Naxsi's administrator duty to add specific rules that will whitelist those legitimate behaviours.

By the way, it is not only GET request you have to worry about, but also POST or any other HTTP method. XSS attack vectors can be anywhere - in the URL, in the coockies, in the POST data, in the user agent header, etc, etc.


To be short I'd recommend you to download Arachni from here, start arachni_web (the WebUI) and to open the URL which will be displayed before. You will be able to test any web site for many existing problems inclusive XSS. I find Arachni very helpful.

UPDATED: If Arachni will find some problem that it will provide detailed instruction how you can reproduce the XSS attack on the example of some page of your site. You will see the exact GET or POST request which Arachni send to the server and the response. For example I found in the way an URL with the Searching form (not on my web site of cause) where an <input> field exist. One and type in the input the text ; /bin/cat /etc/passwd ; and the form will display the content of /etc/passwd. Everybody can reproduce the problem directly in web browser without Arachni. I find such practical example much better as long common theoretical description of the ways of XSS attacks.

  • 2
    I want to know the logic behind it. not just use a tool and get the work done – Tilak Maddy Apr 29 '16 at 11:49
  • @TilakMadichetti: Do you tried it? It displays very detailed descriptions and the instructions how you simulate XSS manually. It shows all HTTP request and response from your site in details and do many other things. Thus it's not just the tool which would say you: yes you have the problem, but explains XSS attack on example of some your page. Moreover XSS is only one problem. It could be that much more other problem exists too. – Oleg Apr 29 '16 at 12:03
  • @TilakMadichetti: It could be for example some <form> on your page (a searching for with input field), where any user can type ; /bin/cat /etc/passwd ; and your form will displays the content of /etc/passwd file. You can open the form manually in web browser and reproduce the reported problem directly. – Oleg Apr 29 '16 at 12:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.