1

I was going through the OWASP XSS Filter Evasion Cheat Sheet and and I came across this section where there is an anchor tag used to do an XSS in the following forms:

<A HREF="//google">XSS</A>
<A HREF="http://ha.ckers.org@google">XSS</A>
<A HREF="http://google:ha.ckers.org">XSS</A>

I can imagine its use in a stored XSS attacks (like some forum post saying "Click me") but I cannot imagine its use in a Reflected XSS attack. Can anyone tell if it's possible to do a reflected XSS using the anchor tag? If yes, how?

0

When there is information used to form the link itself, then it can be done: Imagine a page: http://site.com/redirect.php?target=google.com which will show one of those "You are leaving site.com, we're not responsible... click here to ...". It may put part of your URI (the target parameter) into the HTML code.

If you'd try to escape this with "google.com"%20onclick="alert(document.cookie)", you could form the following:

<a href="http://google.com" onclick="alert(document.cookie)">

Of course, there are many if's - but it can be done.

  • The OWASP document stated Assuming "http://www.google.com/" is pro grammatically [sic] disallowed meaning that anything starting with that string would not be accepted. The document is discussing URL blacklisting rather than how to escape out of a quoted <a> tag. – SilverlightFox Jun 15 '15 at 12:29
2

Sure it's possible as long as a site uses non-persistant data to construct an anchor tag without properly sanitizing the data. A contrived example:

<a href="/whatever?s={Write unsanitized query string value here}">{or maybe here?}</a>

That being said, the link that you posted has to do with URL string evasion and not reflected XSS. Is it possible you are confused on what reflected XSS is? Or possibly I just misunderstood your question :)

  • Na. What you wrote non-persistant data being used to create a query tag answers my question. But I had to accept one answer and the other answer seemed close enough. So, just upvoting it. – Pervy Sage May 6 '14 at 19:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.