So i found a website(lets call it example.com)with a search bar that is not properly sanitized. I was able to pop a alert box with a payload.But i noticed that the URL doesn't change for valid or invalid search query .It always remains www.example.com/search . No query string is being send when i search anything . In other word i cannot pop a alert box on someone else browser by sending them a infected link because URL always remains www.example.com/search.My attacks are only limited to my browser only .

So is this a vulnerability?

here is screenshot of the request enter image description here

  • Start any webinspector of your choice and check wether a GET or POST request is made. Also check for AJAX / XHR Requests. – Dennis Sanders Aug 14 '17 at 12:03
  • 1
    A vulnerability is exploitable by definition. – Tom K. Aug 14 '17 at 12:29

XSS can be exploited not just using query string from URL. In your case, this could be HTTP POST request. If this is HTTP POST request, then the vulnerability is perfectly exploitable. The user, however, does not have to follow your direct link to vulnerable website. Instead, you need to create an HTML form with your payload and autosubmit, place it on some webpage and trick the victim to visit that page. Please, provide at least some technical details, so we do not have to guess.

Exploitation example. Replace [host] with real hostname and add/rename parameters in the form. After that submit the form. You can also create JavaScript to autosumbit the form.

<form method="post" action="http://[host]/search/get_search"> <input
type="hidden" name="seach" value='"><img src=x onerror=alert("XSS")>'>
<input type="submit"> </form>
  • Its is making a POST request .I have attached a screenshot of the request in the original question – shujaat Aug 14 '17 at 12:41
  • Have added an example above – Valery Marchuk Aug 14 '17 at 14:34

It seems like you are speaking about a possible Local XSS vulnerability.

These vulnerabilities take place not at the site, but at user’s local computer, so admins of the sites and web developers often ignore such vulnerabilities. In some cases owners of the sites can do nothing concerning to these vulnerabilities. [source : http://websecurity.com.ua/4219/]

A browser plugin could maybe exploit your found vulnerability to perform some evil

  • 2
    A browser plugin doesn't need such a vulnerability to perform some evil, because they can read and modify site content anyway. – Philipp Aug 14 '17 at 13:17

Not the answer you're looking for? Browse other questions tagged or ask your own question.