If I manage to enter javascript in a website search bar that will then run the javascript on the results page, it only runs on my local session in my browser right? So unless the website stores my javascript-filled query and displays it elsewhere to other users, it won't do anything to other uses will it?


When you enter something in a search bar and it gets executed, it is called reflected XSS because the payload is reflected from the URL (e.g. https://example.com?search=[javascript code]). If it would be stored and displayed to others later it would be what is called, well, stored XSS.

I read your question to be something along these lines: "Is reflected XSS really that dangerous since it only runs on my computer?"

You are correct that reflected XSS will only run in the browser of the person who visit the link - in this case you. Doing refleced XSS on yourself is a bit pointless, since you only need to hit F12 to fire up a console if you want to run some JavaScript on your own machine.

But now think about what happends if you craft an URL that you fool others to visit (send it in an email, post it on Twitter, post it on a forum, etc). Now the JavaScript will be executed in their browser. You could create a link that will log passwords entered by the user who clicks it or steel that users cookies. That is dangerous stuff.

So while stored XSS is arguably more dangerous than reflected XSS, reflected XSS is still a serious issue that should be fixed promptly if discovered.

  • "reflected XSS is still a serious issue" At the very least it can be used to log your activity. If the site with a vulnerability has a password login as you say, then the password could be stolen. Basically anything you do on that site can be stolen even with Reflected XSS. – Bryan Field Nov 8 '16 at 19:38
  • 1
    @GeorgeBailey Exactly. My point about it being somewhat less dangerous is that you have to somehow fool the victim into clicking your link. – Anders Nov 8 '16 at 19:42

It depends. You are talking about 'stored' XSS attacks - that is, you put in some Javascript, the website stores it and shows it to someone else. There are also reflected XSS attacks - that's when a query parameter is exposed and vulnerable to XSS - that is, you can create a URL that contains the attack. You can then make some vulnerable if they click on a link you provide. A link can also contain a DOM-based XSS script - that's where a script on the page uses a query parameter to build its DOM. That can be bad too.

So, three methods of XSS - your website needs to block all three.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.