Access denied after inserting reflected XSS payload in JavaScript

Question

I am getting multi reflection of my input on a websites page, one of the reflections of my input happens to be inside the <script> tag. The script tag that I just mentioned has it's src referring to another domain, called, visualwebsiteoptimizer.com which then refer's to the domain that I am testing my xss on, using the URL: redirect method.

<script src="https://dev.visualwebsiteoptimizer.com/deploy/js_visitor_settings.php?v=1&amp;a=25349&;url=https://www.targetdomain.com/en-us/search-results.aspx/search=helloworld

If I insert a normal text query the output is (varying on the query found or not found), as soon as I insert my payload that is '-alert(1)-' the website gives me a 403 Access Denied. Normal text inputs are okay and render the page, but inserting any payload just gives me a 403.

Can anyone tell me what's going on? Am I getting an XSS but it's just not popping because of some WAF?

Answer 1

Most likely one of the sites in the chain is performing XSS protection not by filtering, but by blacklisting anything deemed dangerous and automatically returning a 403.

As an example, I knew a web developer once who performed all of his XSS and SQLi protection via a 10 page .htaccess file that checked the incoming request against every XSS or SQLi vector he had seen in his ~decade of experience. alert, script, SELECT, etc... if it was a keyword in an attack, it was blacklisted in his .htaccess file and the server would automatically return a 400 Access Denied response, regardless of whether or not there was a vulnerability.

Is it a good strategy for XSS mitigation? I don't think so. But it is definitely a strategy people use, and it is most likely the reason your current attempts are being blocked. A WAF is one possible way that someone might implement such a filter. Regardless of exactly how they do it, of course, the end result is the same: you are stuck until you find an attack vector that their black-list doesn't detect and filter.