I am getting multi reflection of my input on a websites page, one of the reflections of my input happens to be inside the <script> tag. The script tag that I just mentioned has it's src referring to another domain, called, visualwebsiteoptimizer.com which then refer's to the domain that I am testing my xss on, using the URL: redirect method.

<script src="https://dev.visualwebsiteoptimizer.com/deploy/js_visitor_settings.php?v=1&amp;a=25349&;url=https://www.targetdomain.com/en-us/search-results.aspx/search=helloworld

If I insert a normal text query the output is (varying on the query found or not found), as soon as I insert my payload that is '-alert(1)-' the website gives me a 403 Access Denied. Normal text inputs are okay and render the page, but inserting any payload just gives me a 403.

Can anyone tell me what's going on? Am I getting an XSS but it's just not popping because of some WAF?

  • 1
    It's not uncommon to configure WAFs to block suspected XSS attacks and return a 403 if a detection rule is matched. It's quite possible that your attempts are blocked regardless of the application logic, that is, regardless whether your XSS would have actually triggered.
    – Arminius
    Jan 29, 2018 at 14:24
  • The answer to this question is implied, but I want to ask anyway: is it the website you are trying to hit that is returning the 403, or is it the targetdomain.com that is being hit in the ajax request that is returning the 403? Jan 29, 2018 at 14:30
  • the targetdomain is returning the 403. @ConorMancone, I'll just double check that through Burp.
    – j_h_o_m_o
    Jan 29, 2018 at 14:34
  • yes the targetdomain.com is causing the 403 @ConorMancone
    – j_h_o_m_o
    Jan 29, 2018 at 14:58
  • What a strange setup they have going there... with all that cross-domain talk I feel like there has to be room for an XSS vulnerability somewhere... anyway, best of luck to you! Jan 29, 2018 at 15:10

1 Answer 1


Most likely one of the sites in the chain is performing XSS protection not by filtering, but by blacklisting anything deemed dangerous and automatically returning a 403.

As an example, I knew a web developer once who performed all of his XSS and SQLi protection via a 10 page .htaccess file that checked the incoming request against every XSS or SQLi vector he had seen in his ~decade of experience. alert, script, SELECT, etc... if it was a keyword in an attack, it was blacklisted in his .htaccess file and the server would automatically return a 400 Access Denied response, regardless of whether or not there was a vulnerability.

Is it a good strategy for XSS mitigation? I don't think so. But it is definitely a strategy people use, and it is most likely the reason your current attempts are being blocked. A WAF is one possible way that someone might implement such a filter. Regardless of exactly how they do it, of course, the end result is the same: you are stuck until you find an attack vector that their black-list doesn't detect and filter.

  • Thank you for sharing. I was thinking it could've been a WAF as well. Lucky for me @brutelogic has released his XSS cheat sheet today so I shouldn't have too much trouble stringing together a payload. Thank You.
    – j_h_o_m_o
    Jan 29, 2018 at 14:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .