0

I am trying to execute an XSS in an HTTP GET request,but it just displays the input without running the script.

I checked in BurpSuite and I see it added my input to referer: url and then my input.

How can i make the XSS run?

closed as off-topic by Xander, schroeder Mar 20 at 14:37

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – Xander, schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.

1

So you encountered a website that takes a GET or POST request and reflects the input as content somewhere on the website. A good example for this would be Stack Exchange. As you can see, I can type the following and nothing happens:

<script>alert('This is not an XSS')</script>

But why?

Output Encoding

Simply put, the output is properly encoded for the context it is written into. What does that mean? HTML has certain characters with special meanings, such as < and >. In order to prevent a browser from interpreting them as "special", the output automatically replaces special characters with a sequence that is visually identical, but has no special meaning to the browser.

You can verify this by inspecting the above code block and seeing that it turned into the following:

&lt;script&gt;alert('This is not an XSS')&lt;/script&gt;

As you can see, this renders fine for you visually, but does not cause the <script>-tags to be interpreted as HTML tags.

How to make the XSS work

You can't. It's that simple. If the encoding is done properly, such as by a popular framework, then you can't exploit it. That is good! This is what you want for a customer.

I assume you are doing this pentest for a customer, with a written permission to attack, right?

  • Assumption in this field of expertise is overrated ;) – Jeroen - IT Nerdbox Mar 20 at 12:23

Not the answer you're looking for? Browse other questions tagged or ask your own question.