I am trying to execute an XSS in an HTTP GET request,but it just displays the input without running the script.

I checked in BurpSuite and I see it added my input to referer: url and then my input.

How can i make the XSS run?


So you encountered a website that takes a GET or POST request and reflects the input as content somewhere on the website. A good example for this would be Stack Exchange. As you can see, I can type the following and nothing happens:

<script>alert('This is not an XSS')</script>

But why?

Output Encoding

Simply put, the output is properly encoded for the context it is written into. What does that mean? HTML has certain characters with special meanings, such as < and >. In order to prevent a browser from interpreting them as "special", the output automatically replaces special characters with a sequence that is visually identical, but has no special meaning to the browser.

You can verify this by inspecting the above code block and seeing that it turned into the following:

&lt;script&gt;alert('This is not an XSS')&lt;/script&gt;

As you can see, this renders fine for you visually, but does not cause the <script>-tags to be interpreted as HTML tags.

How to make the XSS work

You can't. It's that simple. If the encoding is done properly, such as by a popular framework, then you can't exploit it. That is good! This is what you want for a customer.

I assume you are doing this pentest for a customer, with a written permission to attack, right?

  • Assumption in this field of expertise is overrated ;) – Jeroen Mar 20 '19 at 12:23

Not the answer you're looking for? Browse other questions tagged or ask your own question.