0

While testing a dummy app, I noticed that the XSS done through POST parameters was getting stored in the form (the alert('XSS') would show every time I loaded the page where I had injected the payload). Is it possible to have reflective XSS through POST requests?

1
  • Does the reflected XSS payload show up only for you or for anyone on the site Oct 13, 2019 at 21:32

1 Answer 1

3

The HTTP method does not matter for Cross Site Scripting attacks (XSS). It is even possible to get XSS trough the HTTP TRACE method.

Is it possible to have reflective XSS through POST requests?

Most definitely!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .