In most websites that have account logins, there are at least two fields:

  • Email
  • Password

Could either of these fields be used to mount an XSS attack (assuming no character encoding)?

For example, could this be submitted in the email field of a registration form:

<script src="www.example.com/mymaliciousscript.js"></script>newuser@stackexchange.com

Anything originating from the client can be used for XSS: form fields (including hidden ones), query parameters, even cookies, User-Agent string, and HTTP headers.

Any field, no matter which one, printed back without sanitization is a potential vector for XSS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.