0

I have a webpage in which Email is given as input. It will then display "your email is abc@xyz.com". I am then changing the email in URL to <script>alert(1)</script> and send tbe request again. The system now displays "your email is <script>alert(1)</script>". Only the display message is like this. Script doesn't seem to get executed. Is this XSS vulnerability or just email validation issue?

  • 1
    If the script doesn't get executed maybe the payload is not good..maybe this is not an XSS issue, how's your DOM arranged ? – Soufiane Tahiri Feb 28 at 14:10
  • It is a third party website and I am testing it. Not sure about DOM. Will check that. – user2455158 Feb 28 at 14:20
  • inspect it as html if possible , it might just be html encoded so its safe to display – Bokis Feb 28 at 15:05
2

There could be many reasons the script is not being executed:

  • It is being blocked by a browser filter or a CSP. If this is the case, it would not be displayed on the page, but it would be part of the source code.
  • The fake email is properly encoded. If this is the case, you would see it as e.g. &gt;script&lt; in the source but <script> in the page.
  • It is being inserted into the DOM with JavaScript using a safe method like textContent.

In general, if you see the payload on the page it is a sign that the filtering is working as it should. If you see it unencoded in the source, it is a sign that you have found an XSS vulnerability. In any case, you are correct that the site in question needs better email validation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.