"reflected" XSS attacks delivery to the victim

Question

My Question is specific to reflected XSS attacks.

Are reflected cross site scripting attacks mostly possible when the injectable parameter is part of the URL ? I know vulnerable parameters in header can also be used to launch attacks using flash and other client side technologies. However I implied to this since in most of the execution cases of this attack, requires the victim to click on the crafted URL. Could anyone please explain if there are other ways also (reflected XSS only). Examples would help.

Answer 1

Reflected XSS is possible if the parameter is part of the URL (usually in the query string) or part of the message body in a POST request.

Parameters in headers or cookies cannot usually be used in a reflected XSS attack because there is no way for an attacker to set these headers (custom headers cannot be sent cross-domain without the use of CORS).

They don't always require a click from the victim on the infected URL directly. Say if a website the user usually visits was compromised, the attacker may add

<form method="post" action="https://example.com/submit">

  <input type="hidden" name="textarea1" value="&lt;input onclick=alert(document.cookie)&gt;" />

</form>

<script>
document.forms[0].submit();
</script>

to the HTML (watering hole attack).

Note that if a web page is vulnerable to a POST body reflected XSS attack, then this can also be mitigated via anti-CSRF protections instead of proper HTML output encoding (although in the spirit of defense in depth I would also recommend fixing the actual XSS vulnerability because there might be other attack vectors which could exploit this).