1

My Question is specific to reflected XSS attacks.

Are reflected cross site scripting attacks mostly possible when the injectable parameter is part of the URL ? I know vulnerable parameters in header can also be used to launch attacks using flash and other client side technologies. However I implied to this since in most of the execution cases of this attack, requires the victim to click on the crafted URL. Could anyone please explain if there are other ways also (reflected XSS only). Examples would help.

1

Reflected XSS is possible if the parameter is part of the URL (usually in the query string) or part of the message body in a POST request.

Parameters in headers or cookies cannot usually be used in a reflected XSS attack because there is no way for an attacker to set these headers (custom headers cannot be sent cross-domain without the use of CORS).

They don't always require a click from the victim on the infected URL directly. Say if a website the user usually visits was compromised, the attacker may add

<form method="post" action="https://example.com/submit">

  <input type="hidden" name="textarea1" value="&lt;input onclick=alert(document.cookie)&gt;" />

</form>

<script>
document.forms[0].submit();
</script>

to the HTML (watering hole attack).

Note that if a web page is vulnerable to a POST body reflected XSS attack, then this can also be mitigated via anti-CSRF protections instead of proper HTML output encoding (although in the spirit of defense in depth I would also recommend fixing the actual XSS vulnerability because there might be other attack vectors which could exploit this).

  • Found a very good resource explaining how reflected XSS in post body paramater is exploited. hackers2devnull.blogspot.com.au/2013/07/… – jubilant Aug 25 '16 at 12:53
  • The article claims it works if X-Frame-Options is set, however I can't see how it does that unless the meta refresh kicks in after the form has started to be submitted. – SilverlightFox Aug 25 '16 at 14:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.