I am a beginner in security testing. I was testing a form in a website for XSS vulnerabilities and I noticed that the data is sent as JSON data with XHR request and the response is also as JSON.

Is it is possible to search for XSS in such forms or is it a waste of time?


Very rarely, but yes. A perfect example would be when the application dynamically retrieves URL's to be shown as links, you could inject code like so:

{url: "javascript:alert(document.cookie);", title: "Click me for cookies"}

<a href="{{ url }}">{{ title }}</a>

Either that or the URL is parsed using the eval() statement (even more rare, but I've seen it happen)

  • Thx for your reply ..regarding your example do you mean that if you submitted a link in a form and the application show is as a clickable link ? – Mohamed Osama Feb 13 '17 at 7:50
  • @MohamedOsama yes, if you can get a server to output a link on someone's web page with the href tag starting with javascript: you've got yourself some XSS – Paradoxis Feb 13 '17 at 7:58
  • I read that you can prevent such attacks if you set X-Content-Type-Options: nosniff and Content-Type to application/json .. do you believe that these techniques will prevent XSS ? – Mohamed Osama Feb 13 '17 at 11:15
  • @MohamedOsama Content-Type will only prevent code execution in the request itself (if set to text/html you would have been able to with any valid HTML) and X-Content-Type-Options only prevents your browser from overriding the given content type. I reccomend you check OWASP's XSS cheat sheet if you want to learn more – Paradoxis Feb 13 '17 at 11:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.