Im a beginner in WASA. What are the probable ill effects of having a reflected XSS vulnerability on the login page? Lets say reflected XSS is identified in the username parameter on the login page.
- Chuck sends their victim(s) a link to the target site (
example.com, containing an XSS payload in the query string).
- Bob clicks the link.
- Bob checks the address bar to make sure it is
httpsprotocol, padlock, and has the expected domain.
- As the address bar shows
https://example.com, Bob proceeds to login.
- Upon click of the Login button, Chuck's payload runs and sends Bob's username and password to Chuck's website using an AJAX request: