0

Is there a way to execute XSS? on 302 redirect and the body on the page?

<HTML><HEAD>
<TITLE>302 Moved Temporarily</TITLE>
</HEAD>
<BODY>
The document has moved <A HREF="https://Example.com/">here</A>
</BODY></HTML>

I can breakout with " but i can't use any character after < or whole parameter would be removed. Maybe there is a workaround to "stop" the redirect and show HTML? I'm almost 99.99% sure there is a way to break it somehow.

  • 3
    I don't think that the browser renders the body at all on a proper redirect (i.e. status code 302 and Location header). The body is only their for the unusual case of very old clients which don't know what 302 means - i.e. irrelevant. – Steffen Ullrich Oct 11 '18 at 14:34
4

In many cases a 302 redirect will not contain a body at all.

The RFC only requires a header to indicate the status 302 and the location the user should be redirected to.

As Steffen said, modern browsers ignore the body of the redirect and directly issue a GET for the location specified in the header.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.