I've found an xss bug inside user-agent header on one popular buy/sell site , and after reporting it to them , they answered that it is not dangerous as it can not be exploited without user interaction(changing user-agent header manually). So I wanted to ask , is there any way to send user-agent and request that same page with spoofed user-agent. Can any web programming language do that? Thanks
It is not possible for an attacker to control the user-agent in a cross site request. Usually XSS payloads are simple
.submit() or an
It is possible to exploit XSS via some HTTP headers using Flash. However, flash has a blacklist of http headers. The user-agent was blacklisted in version 9.0.28, so once upon a time you could exploit user-agent based XSS. I wrote the CSRF-Request-Builder to take advantage of Flash's control over HTTP headers.