I am trying to understand XSS. I have basic understanding of reflected, stored XSS and how they should work. In this particular case the code that i inject is getting returned in the source of the page but I do not get any prompt/pop-up like the usual alert.

Say I inject <script>alert("XSS")</script>

But i can see the string that I passed return in the source. Is it possible to exploit it? is this behavior secure?

Can anyone please help me understand this.

  • Are you using any add-ons like NoScript? Sep 15 '16 at 9:03

I think probably the XSS is mitigated using Response Headers like

  1. X-XSS-Protection
  2. Content-Security-Policy
  3. X-Content-Type-Options

You can read more about these Headers here . If these headers are implemented properly, the injected script will not be executed as Javascript by browser and prevents XSS.

  • 1
    For the sake of completeness, giving link here on how to mitigate - owasp.org/index.php/… Sep 15 '16 at 9:07
  • Also wondering can html/javascript escape come in play here? Sep 15 '16 at 9:08
  • Why do these headers prevent the script from executing? Please expand your answer to explain. Sep 15 '16 at 15:05

Try same scenario on Mozilla Firefox. I think you are using chrome, it has a functionality to block JavaScript popup

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.