I've been learning about XSS recently, and then I was trying to come up with ways to bypass anti-XSS filters in browsers. I though, "Maybe if you used a link shortener that virtualized your site!", similar to how a proxy site virtualizes pages, or W3Schools' Try It Editor (except it doesn't show code). The concept is that a link shortener would use a suspicious link and render the page into a virtualizer.

For example, Bob finds an XSS vulnerability in a site and shorten it into a shortened link; any shortened link less suspicious than https://vulnerable.com/<scRIPt>alert("XSSed!");</scriPT>. Bob would use the virtualizing URL shortener and put the above URL as the link and it would be virtualized into an <iframe> or something and not warn the user of malicious code and then send it to someone, who would then click on it.

Would this work to bypass XSS filters? Does a site like this already exist?

  • How would a link shortener solve that? Could you be a little more specific on the approach you're suggesting?
    – Arminius
    Commented Apr 27, 2017 at 22:58
  • There, I edited it.
    – anonymous
    Commented Apr 27, 2017 at 23:08

1 Answer 1


Ordinary URL shorterners are commonly used to hide the payload and make links look less suspisious. However, they do not help against the browsers XSS filters, since what an ordinary URL shorterner does is simply issuing a redirect.

You suggest an approach to bulding an URL shorterner that does bypass the browsers XSS filters using what you call virtualization instead of redirects.

The way to do this virtualization would be using an iframe. The only problem is that the browsers XSS filter will (probably) be protecting the iframe in the same way that it is protecting you when you enter a URL in the URL bar. So you don't win anything.

And using an iframe is the only way I can think of doing "virtualization" without running into the SOP. So I don't think this is a viable concept.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .