I am learning about XSS vulnerability. I need to know what sort of XSS attack can be done on clean URLs.
Clean URL example :
I am a little unclear on what you mean by
what sort of xss attack can be done on clean urls so I'm going to go over both types of XSS for your situation.
It really depends on how that URL is being used to render the page. First lets talk about two different types of XSS.
Reflected XSS: Part of your URL is rendered on the page and the attack payload is part of your URL. You need to trick users into clicking your link to execute the attack.
Stored XSS: The XSS is stored on the server itself due to insecure programming. Then when a user visits the page with the XSS payload, the attack is called up from the server. The user just needs to visit the page, no link clicking required.
So lest look at your example URL:
When I first look at this I don't see anything that jumps out as being rendered to the page, but for arguments sake lets say you are rendering the last parameter (1). If you change the URL to this:
and you tricked a user into clicking that link, it would display
xss in an alert box on their page. This is a reflected XSS attack.
My answer to question 1<script>alert('xss');</script>
Now anyone who views that answer will see an alert box that says
There's no reason why you can't just do something like:
However, having said that, it totally depends on how the output is being rendered, whether the characters are being encoded using HTML Entities or HTML Special Characters, or if they are just being output as plain text.
The thing you need to do is called "Fuzzing", where by you add junk characters into an input (be it an inputbox or a URL or whatever) and see how they come back in the source.
I always use something to identify my string input, so in the above case it's
banhammer so it is easy to search for through the source.
Also, note the
\t in there? That is due to many applications on the web will use (strip|add)cslashes (at least in PHP) which if used incorrectly can cause XSS to be executed correctly.