0

While testing a dummy app, I noticed that the XSS done through POST parameters was getting stored in the form (the alert('XSS') would show every time I loaded the page where I had injected the payload). Is it possible to have reflective XSS through POST requests?

  • Does the reflected XSS payload show up only for you or for anyone on the site – Conor Mancone Oct 13 '19 at 21:32
3

The HTTP method does not matter for Cross Site Scripting attacks (XSS). It is even possible to get XSS trough the HTTP TRACE method.

Is it possible to have reflective XSS through POST requests?

Most definitely!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.