I've found a reflected XSS, but the problem is that the attack vector is the header (any header). Is there a way to develop an exploit scenario based on this?

2 Answers 2


One way to exploit this is to combine it with a cache poisoning attack. This happens when a server-side intermediate cache stores your page with the XSS payload, and then serves it to everyone from the cache.


Typically no, assuming it can only be used for reflected XSS. There's no way to add custom headers to navigation or resource requests, and cross-site scripted requests can have custom headers but that will trigger a CORS preflight that presumably would fail, and even if it didn't, the response presumably wouldn't be rendered (certainly not in the target origin) so it wouldn't be of any use anyhow.

If there's a way to achieve a stored XSS, that's another story entirely. Alternatively, depending on exactly how the headers are being processed by the server, there might be risks where the headers could be used for other attacks including attacks against the server itself e.g. SQLi, command injection, and so on (servers normally completely ignore unexpected headers; this one is doing something weird and anywhere there's one weirdness, you should check for more).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .