I am a beginner in security testing. I was testing a form in a website for XSS vulnerabilities and I noticed that the data is sent as JSON data with XHR request and the response is also as JSON.

Is it is possible to search for XSS in such forms or is it a waste of time?

1 Answer 1


Very rarely, but yes. A perfect example would be when the application dynamically retrieves URL's to be shown as links, you could inject code like so:

{url: "javascript:alert(document.cookie);", title: "Click me for cookies"}

<a href="{{ url }}">{{ title }}</a>

Either that or the URL is parsed using the eval() statement (even more rare, but I've seen it happen)

  • Thx for your reply ..regarding your example do you mean that if you submitted a link in a form and the application show is as a clickable link ? Feb 13, 2017 at 7:50
  • @MohamedOsama yes, if you can get a server to output a link on someone's web page with the href tag starting with javascript: you've got yourself some XSS
    – Paradoxis
    Feb 13, 2017 at 7:58
  • I read that you can prevent such attacks if you set X-Content-Type-Options: nosniff and Content-Type to application/json .. do you believe that these techniques will prevent XSS ? Feb 13, 2017 at 11:15
  • @MohamedOsama Content-Type will only prevent code execution in the request itself (if set to text/html you would have been able to with any valid HTML) and X-Content-Type-Options only prevents your browser from overriding the given content type. I reccomend you check OWASP's XSS cheat sheet if you want to learn more
    – Paradoxis
    Feb 13, 2017 at 11:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.