Is there any plugin out there which prevent reflected XSS? Plugin could be either for firefox or chrome.


closed as off-topic by NULLZ, Xander, Adi, TildalWave, Iszi Oct 3 '13 at 18:37

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • no-script for firefox, none of these filers work very well. – rook Oct 1 '13 at 16:30

Chrome ( and most likely Firefox ) already prevent execution of scripts when they are given in for example the URL parameter, maybe even other things like a request body, and then proceed to give you a warning.

See also Does Google Chrome protect against cross site scripting (XSS)?

Also when you search for XSS prevention in the chrome extension store, you will get results.

  • I tried a reflected XSS on insecurelabs.org/Task/Rule1. It works in chrome as well as firefox. here search box in vulnerable to xss – Naman Oct 1 '13 at 14:49
  • That website sends an http header of "X-XSS-Protection:0", you can guess what that does. You cannot use that website to test a browser's XSS Protection. See also this question – Philipp Gayret Oct 1 '13 at 15:11
  • Nice. But now I am making a simple page and running it on apache local server, still reflected xss happening – Naman Oct 1 '13 at 17:01
  • What would you say about victim.kotowicz.net/alphabet-hero/vuln.html – Naman Oct 1 '13 at 17:04
  • That is a page where javascript reads the input field and just appends the text as html, the xss data does not come from a request... – Philipp Gayret Oct 2 '13 at 7:24

Not the answer you're looking for? Browse other questions tagged or ask your own question.