-1

I have a domain which when opened shows :

enter image description here

Whatever I type after xyz.com/whatever appears on the title bar as xyz.com/whatever , if i write xyz.com/stackoverflow the title bar shows the same as xyz.com/stackoverflow.

Is there any XSS that i can perform here??

  • Why do you think that this behavior means that it is vulnerable to XSS? – schroeder Mar 5 at 8:44
  • If i write xyz.com/<script>....</script> in the url then the same appears in the titlebar, so i think can i do some xss as <script> tag is roaming freely. – Vishwa Ratna Mar 5 at 8:47
  • then you might want to mention that behavior – schroeder Mar 5 at 8:50
  • and then it's not the domain that might be vulnerable, but the site – schroeder Mar 5 at 8:52
  • For sites that don't set the <title> element, the browser displays the URL as the title. Pretty sure that's what's happening here, and it's not at all exploitable. Check the actual HTTP response to see what's in the body (specifically, whether it contains HTML elements from your request), though. It could have an XSS injection point at the part inside the parentheses. – CBHacking Mar 5 at 9:36
5

Probably not. XSS is only possible when the browser interpret the response from the server as HTML. This is triggered by the following response header:

Content-Type: text/html

In your case, it seems that the browser interprets the response as text, as indicated by this header:

Content-Type: text/plain

In that case, the browser does not interpret HTML and tags will show up as tags.

I base this conclusion on the font of your screenshot. Of course it could also be a HTML page with a particular font.

Sometimes it is still possible to trick the browser into rendering HTML, even when the content-type says otherwise. This is because browsers sometimes do MIME-type sniffing: they try to guess the content type of the page.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.