There is a lot of information on how to avoid or detect XSS, but I couldn't find much information on how to monitor for reflected XSS. Is there a way to automatically detect reflected XSS in my application's logs? My guess is that we can run a parser on the logs and signal all the possible reflected XSS attacks. Is there a library already that does this?

  • You're probably just looking for a WAF. Granted, these are not monitoring solutions, but I suspect they will do what you need anyway. – Conor Mancone Aug 14 '20 at 13:46

There are manual approaches and tools to analyze your logs (see eg here); but listing tools themselves would be off-topic here.

The problem with these approaches is that you are not monitoring for suggessful XSS attacks, but for attempts. This can also be useful to know how attackers are attacking your application, but there will be a lot of noise from automated scanner, etc.

It doesn't seem like this is what you necessarily want though. If you actually want to monitor for successful XSS attacks, you may want to consider using the reporting feature of CSP. You can also use it as report-only without negatively affecting usability of your application.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.