I'm new to penetration testing and I found a Reflected XSS vulnerability on the website I'm working on.

But the thing is when I submit the form, the website automatically redirects me to www.website.com/sendform.php without showing the parameters in the URL.

Is there a way to exploit the XSS vulnerability in a way that I can send it through links?

2 Answers 2


It sounds like you are asking how to tamper with form submissions that are sent in the body via POST, not as part of the URL as with GET.

The way to do this is with a man-in-the-middle proxy such as Burp or ZAP. They will allow you to intercept, read, and modify requests being sent from the browser to the server. As an example, if there are client-side content checks, this allows you to bypass them.


To add to what gowenfawr said, a POST-based XSS can be used to pivot and it can be used in conjunction with other vulnerabilities, but alone, it has no practical usage, because like he said, you cannot embed that POST request into a link.

On weird occasions it can be possible. Look into OOB/BLIND XSS using XSSHunter and crafting a CSRF request. Depending on the response and how the xss fires you might be able to see user information.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .