How to detect XSS in HTTP/1.1 GET requests? A request can be malicious and I want to know how to detect if the GET request to a server is trying to XSS my website?
You should not only protect yourself from XSS by scanning HTTP requests for attacks. Such a scan will never be complete, and there will always be some smart tricks that slip through the net. Your first line of defence must always be to properly sanitize untrusted data, so as not to create any XSS vulnerabilities in the first place.
For how to do that, see OWASPs cheat sheat on the topic. If possible, I would recommend you to set the Content Security Policy header strictly, as this will give you a solid defence on modern browsers. It even has a reporting directive that will instruct the browser to inform you about attempted attacks.
That said, for defence in depth it can be good to also scan HTTP requests to filter out any XSS attacks you can detect. Most web application firewalls, like Naxsi for Nginx, will do that. I recommend using an existing WAF here and not try to roll your own - there is no simple regex that will catch all XSS attacks.
So how does Naxsi do it? According to themself:
This module, by default, reads a small subset of simple (and readable) rules containing 99% of known patterns involved in websites vulnerabilities. For example,
dropare not supposed to be part of a URI.
Being very simple, those patterns may match legitimate queries, it is Naxsi's administrator duty to add specific rules that will whitelist those legitimate behaviours.
By the way, it is not only GET request you have to worry about, but also POST or any other HTTP method. XSS attack vectors can be anywhere - in the URL, in the coockies, in the POST data, in the user agent header, etc, etc.
To be short I'd recommend you to download Arachni from here, start arachni_web (the WebUI) and to open the URL which will be displayed before. You will be able to test any web site for many existing problems inclusive XSS. I find Arachni very helpful.
UPDATED: If Arachni will find some problem that it will provide detailed instruction how you can reproduce the XSS attack on the example of some page of your site. You will see the exact GET or POST request which Arachni send to the server and the response. For example I found in the way an URL with the Searching form (not on my web site of cause) where an
<input> field exist. One and type in the input the text
; /bin/cat /etc/passwd ; and the form will display the content of
/etc/passwd. Everybody can reproduce the problem directly in web browser without Arachni. I find such practical example much better as long common theoretical description of the ways of XSS attacks.