I've my this webapp running on localhost. I've been trying to reflect XSS through this input tag but it's not working for some reason. could someone please tell how to have it reflected?

the payload i put is: "/> <script>alert('xss')</script> <br class="

and this came up: <input class="form-control form-control-lg" id="username" name="username" required="" type="text" value="&quot;/> <script>alert('xss')</script> <br class=&quot;">

1 Answer 1


It looks like you're trying to insert JavaScript in a field which gets serialized by the server.
This means that this input field (or at least not with this payload) is not vulnerable for XSS.

You can try using simply <script>alert('xss')</script>.
If the value of this field will be used without serialization, you have a successful XSS.
Also have a look at these sources:

Not the answer you're looking for? Browse other questions tagged .