Related to my previous question on XSS in canonical link.

At the beginning I turned off Chrome's XSS auditor and tried executing XSS with just onload event using following payload which did not trigger.

" onload="alert(1)

But when I turned ON XSS auditor Chrome gave a warning as follows:

enter image description here

My question is why XSS was not triggered when XSS auditor was OFF ?


The XSS auditor can be triggered even if your payload isn't working, and sometimes even if there's no XSS vulnerability at all!

The XSS auditor just looks at the request parameters to check if there's a match with a part of the response.

To understand why your payload isn't working, disable the XSS auditor and look at the HTML source / developer console.

  • Does that mean Chrome's XSS auditor gives a lot of false positives ? – Rahul Mar 24 '19 at 22:57
  • @user101: Yes! Those false positives can even be triggered to exploit another type of vulnerability: medium.com/@terjanq/google-books-x-hacking-29c249862f19 – Benoit Esnard Mar 25 '19 at 6:29
  • @user101: Note that a XSS is present in your example, based on the output from the other question. Chrome detects it and blocks it successfully, even if your payload didn't impact the page in any way. – Benoit Esnard Mar 25 '19 at 6:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.